Considering the webapps:
 * gn-legacy
 * gn-ebrim

Gn-legacy will offer this webservice interface to gn-ebrim:
 * Set isoIds getIsoIds(userid, password);

[[Image(EbrimSequenceDiagramSecurity.png)]]


== lifeline: ebrim-client ==
This is any client who is using the CSW services from the ebrim application.

== lifeline: geonetwork-web-ebrim ==
This is the ebrim application, which implements the CSW. 

== lifeline: geonetwork-legacy ==
This is the geonetwork application, which implements the iso CSW. 

== method: getEbrimDocument(s) ==
The method name getEbrimDocument(s) refers to a CSW operation which can be for instance GetRecordById. 
In the request header a userId and password be provided. 
Note: is the GetRecordById operation the only relevant one in this context?

== method: calculateRelatedIsoDocuments ==
One ISO document refers to 1 or more EBRIM document. More Ebrim documents may therefore refer to more ISO documents. 

== method: getIsoIds(userid, password) ==
The Ebrim webapp asks via a webservice to geonetwork-legacy for a set  of ISO ids which he is allowed to see. This set contains all public documents when no userid/password is provided. When a userid/password is provided, the returned set contains also the ISO ids for which that user has read permissions. 

== method: intersectAllowedWithRequested ==
The set of Ebrim documents requested can be related to a set of ISO documents. The set of Iso documents reqeusted should be filtered for those ISO ids for which the user does not have acces. 

== methodReturn: return ebrim document(s) ==
Relate the set of allowed Iso ids to a set of ebrim ids. Return this set of ebrim documents. 

Note: Geonetwork-legacy needs to be extended with a webservice, implementing the Set isoIds getIsoIds(userid, password) operation.