Index: test/edu/ucsb/nceas/metacattest/AccessControlTest.java
===================================================================
--- test/edu/ucsb/nceas/metacattest/AccessControlTest.java	(revision 7136)
+++ test/edu/ucsb/nceas/metacattest/AccessControlTest.java	(revision 7137)
@@ -1075,6 +1075,10 @@
 	}
 
 	/**
+	 * NOTE: as of Metacat 2.0.0, denyFirst permOrder is not supported.
+	 * Access rules with denyFirst are ignored and only the document owner 
+	 * has access to the object (default).
+	 * 
 	 * Tests Tests a version 2.0.1 EML document when permission order is
 	 * denyFirst, the combination of allow and deny rules affect user to read,
 	 * update and delete a document. Here are test cases 1.An user inserts a
@@ -1132,7 +1136,7 @@
 	 * failure
 	 */
 	public void test201DenyFirst() {
-		debug("\nRunning: test201DenyFirst()");
+		debug("\nRunning: test201DenyFirstIgnore()");
 		String emlVersion = EML2_0_1;
 		try {
 			newdocid = generateDocumentId();
@@ -1139,6 +1143,7 @@
 			// ====1 inserts a document with access rules (denyFirst) - allow
 			// READ rule for another user,
 			// deny READ rule for public.
+			// all are ignored
 			String accessRule1 = generateOneAccessRule(anotheruser, true, true, false,
 					false, false);
 			String accessRule2 = generateOneAccessRule("public", false, true, false,
@@ -1161,8 +1166,8 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
 			// fails to update this document
 			updateDocumentId(newdocid + ".2", testdocument, FAILURE, true);
 			// fails to update access part
@@ -1201,10 +1206,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".2", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".3", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".2", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".3", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1240,18 +1245,18 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".4", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".5", testdocument, SUCCESS, false);
-			// succeed to update access part
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".4", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".5", testdocument, FAILURE, true);
+			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
 					null, null, null, null, getAccessBlock(anotheruser, true, true, true,
 							true, true), null, null, null, null);
-			updateDocumentId(newdocid + ".6", testdocument, SUCCESS, false);
-			// succeeds to delete the document
-			deleteDocumentId(newdocid + ".6", SUCCESS, false);
+			updateDocumentId(newdocid + ".6", testdocument, FAILURE, true);
+			// fails to delete the document
+			deleteDocumentId(newdocid + ".6", FAILURE, true);
 			// logout
 			debug("logging out");
 			m.logout();
@@ -1282,10 +1287,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".2", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".2", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1323,10 +1328,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".10", testdocument, SUCCESS, false);
-			// succeed to update this document
-			updateDocumentId(newdocid + ".11", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".10", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".11", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1367,8 +1372,8 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".13", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".13", testdocument, FAILURE, true);
 			// fails to update this document
 			updateDocumentId(newdocid + ".14", testdocument, FAILURE, true);
 			// fails to update access part
@@ -1411,10 +1416,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".14", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".15", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".14", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".15", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1454,18 +1459,18 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".16", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".17", testdocument, SUCCESS, false);
-			// succeeds to update access part
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".16", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".17", testdocument, FAILURE, true);
+			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
 					null, null, null, null, getAccessBlock(anotheruser, true, true, true,
 							true, true), null, null, null, null);
-			updateDocumentId(newdocid + ".18", testdocument, SUCCESS, false);
-			// succeeds to delete the document
-			deleteDocumentId(newdocid + ".18", SUCCESS, false);
+			updateDocumentId(newdocid + ".18", testdocument, FAILURE, true);
+			// fails to delete the document
+			deleteDocumentId(newdocid + ".18", FAILURE, true);
 			// logout
 			debug("logging out");
 			m.logout();
@@ -1499,10 +1504,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeed to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".20", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".20", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1543,10 +1548,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".21", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".22", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".21", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".22", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1568,6 +1573,10 @@
 	}
 
 	/**
+	 * NOTE: as of Metacat 2.0.0, denyFirst permOrder is not supported.
+	 * Access rules with denyFirst are ignored and only the document owner 
+	 * has access to the object (default).
+	 * 
 	 * Tests Tests a version 2.1.0 EML document when permission order is
 	 * denyFirst, the combination of allow and deny rules affect user to read,
 	 * update and delete a document. Here are test cases 
@@ -1640,7 +1649,7 @@
 	 * this document - failure.
 	 */
 	public void test210DenyFirst() {
-		debug("\nRunning: test210DenyFirst()");
+		debug("\nRunning: test210DenyFirstIgnore()");
 		String emlVersion = EML2_1_0;
 		try {
 			newdocid = generateDocumentId();
@@ -1669,8 +1678,8 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
 			// fails to update this document
 			updateDocumentId(newdocid + ".2", testdocument, FAILURE, true);
 			// fails to update access part
@@ -1709,10 +1718,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".2", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".3", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".2", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".3", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1748,18 +1757,18 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".4", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".5", testdocument, SUCCESS, false);
-			// succeed to update access part
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".4", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".5", testdocument, FAILURE, true);
+			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
 					null, null, null, null, getAccessBlock(anotheruser, true, true, true,
 							true, true), null, null, null, null);
-			updateDocumentId(newdocid + ".6", testdocument, SUCCESS, false);
-			// succeeds to delete the document
-			deleteDocumentId(newdocid + ".6", SUCCESS, false);
+			updateDocumentId(newdocid + ".6", testdocument, FAILURE, true);
+			// fails to delete the document
+			deleteDocumentId(newdocid + ".6", FAILURE, true);
 			// logout
 			debug("logging out");
 			m.logout();
@@ -1790,10 +1799,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".2", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".2", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1831,10 +1840,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".10", testdocument, SUCCESS, false);
-			// succeed to update this document
-			updateDocumentId(newdocid + ".11", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".10", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".11", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1875,8 +1884,8 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".13", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".13", testdocument, FAILURE, true);
 			// fails to update this document
 			updateDocumentId(newdocid + ".14", testdocument, FAILURE, true);
 			// fails to update access part
@@ -1919,10 +1928,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".14", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".15", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".14", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".15", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -1962,18 +1971,18 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".16", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".17", testdocument, SUCCESS, false);
-			// succeeds to update access part
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".16", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".17", testdocument, FAILURE, true);
+			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
 					null, null, null, null, getAccessBlock(anotheruser, true, true, true,
 							true, true), null, null, null, null);
-			updateDocumentId(newdocid + ".18", testdocument, SUCCESS, false);
-			// succeeds to delete the document
-			deleteDocumentId(newdocid + ".18", SUCCESS, false);
+			updateDocumentId(newdocid + ".18", testdocument, FAILURE, true);
+			// fails to delete the document
+			deleteDocumentId(newdocid + ".18", FAILURE, true);
 			// logout
 			debug("logging out");
 			m.logout();
@@ -2007,10 +2016,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeed to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".20", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".1", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".20", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
@@ -2051,10 +2060,10 @@
 			debug("logging in as: anotheruser=" + anotheruser + " anotherpassword="
 					+ anotherpassword);
 			m.login(anotheruser, anotherpassword);
-			// succeeds to read this document
-			readDocumentIdWhichEqualsDoc(newdocid + ".21", testdocument, SUCCESS, false);
-			// succeeds to update this document
-			updateDocumentId(newdocid + ".22", testdocument, SUCCESS, false);
+			// fails to read this document
+			readDocumentIdWhichEqualsDoc(newdocid + ".21", testdocument, FAILURE, true);
+			// fails to update this document
+			updateDocumentId(newdocid + ".22", testdocument, FAILURE, true);
 			// fails to update access part
 			testdocument = getTestEmlDoc(
 					"Testing user can not read, write and delete a document", emlVersion,
Index: src/edu/ucsb/nceas/metacat/DBSAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 7136)
+++ src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 7137)
@@ -142,9 +142,10 @@
 
     boolean hasTriple = false;
     
-	protected boolean writeAccessRules = true;   	   	
+	protected boolean writeAccessRules = true;   
+	
+	protected boolean ignoreDenyFirst = true;
 
-
     public static final String ECOGRID = "ecogrid://";
 
     private Logger logMetacat = Logger.getLogger(DBSAXHandler.class);
Index: src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 7136)
+++ src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 7137)
@@ -1963,6 +1963,10 @@
        // will be write into xml_accesssubtee table
        AccessSection newAccess = resolveAccessRuleReference(access);
        String permOrder = newAccess.getPermissionOrder();
+       if (permOrder.equals(AccessControlInterface.DENYFIRST) && ignoreDenyFirst) {
+    	   logMetacat.warn("Metacat no longer supports EML 'denyFirst' access rules - ignoring this access block");
+    	   return;
+       }
        Vector accessRule = newAccess.getAccessRules();
 
        if (describeIdList == null || describeIdList.isEmpty())
@@ -2035,6 +2039,10 @@
        AccessSection newAccess = resolveAccessRuleReference(topAccessSection);
        //System.out.println("permorder in new level" + newAccess.getPermissionOrder());
        String permOrder = newAccess.getPermissionOrder();
+       if (permOrder.equals(AccessControlInterface.DENYFIRST) && ignoreDenyFirst) {
+    	   logMetacat.warn("Metacat no longer supports EML 'denyFirst' access rules - ignoring this access block");
+    	   return;
+       }
        Vector accessRule = newAccess.getAccessRules();
        String subtree     = null;
        
Index: src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 7136)
+++ src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 7137)
@@ -1215,6 +1215,12 @@
 
 			// if accessSection is not null and is not reference
 			if (accessSectionObj.getReferences() == null) {
+				// check for denyFirst permOrder
+				String permOrder = accessSectionObj.getPermissionOrder();
+				if (permOrder.equals(AccessControlInterface.DENYFIRST) && ignoreDenyFirst) {
+					logMetacat.warn("Metacat no longer supports EML 'denyFirst' access rules - ignoring this access block");
+			    	return;
+			    }
 				// write the top level access module into xml_accesssubtree to
 				// store info and then when update to check if the user can
 				// update it or not
@@ -1242,6 +1248,12 @@
 				for (int i = 0; i < accessObjectList.size(); i++) {
 					AccessSection accessObj = accessObjectList.elementAt(i);
 					String accessObjId = accessObj.getSubTreeId();
+					// check for denyFirst permOrder
+					String permOrder = accessObj.getPermissionOrder();
+					if (permOrder.equals(AccessControlInterface.DENYFIRST) && ignoreDenyFirst) {
+						logMetacat.warn("Metacat no longer supports EML 'denyFirst' access rules - ignoring this access block, subtree id: " + accessObjId);
+				    	continue;
+				    }
 					if (referenceId != null && accessObj != null
 							&& referenceId.equals(accessObjId)) {
 						// make sure the user didn't change any thing in this
@@ -1375,8 +1387,15 @@
 				// If the distribution doesn't have an access section, we continue.
 				if (accessSection == null) {
 					continue;		
-				} 
+				}
 				
+				// check for denyFirst permOrder
+				String permOrder = accessSection.getPermissionOrder();
+				if (permOrder.equals(AccessControlInterface.DENYFIRST) && ignoreDenyFirst) {
+					logMetacat.warn("Metacat no longer supports EML 'denyFirst' access rules - ignoring this access block: " + distributionSection.getDataFileName());
+			    	continue;
+			    }
+				
 				// We want to check file permissions for all online data updates and inserts, or for 
 				// inline updates.
 //				if (distributionType == DistributionSection.DATA_DISTRIBUTION
Index: README
===================================================================
--- README	(revision 7136)
+++ README	(revision 7137)
@@ -58,6 +58,7 @@
 This major release includes support for DataONE.
 *The DataONE v1.0.0 Member Node service APIs are now the preferred method for communicating with Metacat
 *The existing EcoGrid and Metacat Servlet APIs are deprecated.
+*EML-embedded access control rules using permOrder="denyFirst" are no longer supported (https://redmine.dataone.org/issues/2614) 
 *Bugs fixed include:
 <bugs here>
 
