Indicate ORCID iDs are unauthenticated in metadata export plugins

[kaitlinnewson]

Describe the bug
The ORCID documentation notes the following about unauthenticated ORCID iDs:

Whenever unauthenticated ORCID IDs are shared with other systems, for example via data exports, data dumps, or API integrations, it must be made clear that the ORCID iDs are unauthenticated within the provided metadata.

A quick scan and check-in with @ewhanson indicates that most metadata exports that include ORCID iDs are not checking and indicating when unauthenticated. We'll need to review all export plugins which include ORCID iDs and ensure that they check for authentication and indicate when the ORCID iD is unauthenticated (e.g exported as https://orcid.org/.... (unauthenticated)) .

Additionally, we will need to confirm how to metadata schema for downstream receivers (e.g. Crossref) expects unauthenticated ORCID iDs to be formatted. If there is no way to indicated an ORCID iD is not authenticated, then we should consider only exporting the ORCID when it has been authenticated.

What application are you using?
OJS, OMP or OPS all versions (checking for authentication and inclusion of ORCID iDs may be different between versions).

List of plugins exporting ORCID iDs

• Crossref (OJS & OPS) (s. https://data.crossref.org/reports/help/schema_doc/5.3.1/index.html#ORCID)
• Datacite (no way to indicate an ORCID iD is unauthenticated)
• DOAJ (no way to indicate an ORCID iD is unauthenticated)
• Pubmed
• OAI endpoints (marc/marcxml)
• JATS template
• medra

Pull requests

• Crossref OJS: pkp/pkp-lib#10796 indicate if orcid is authenticated crossref-ojs#55
• Crossref OPS: pkp/pkp-lib#10796 indicate if orcid is authenticated crossref-ops#43
• Datacite, DOAJ, Pubmed, OAI marc/marcxml: pkp/pkp-lib#10796 check if ORCID is verified in export plugins ojs#4618
• JATS Template: pkp/pkp-lib#10796 update orcidAccessToken to orcidIsVerified jatsTemplate#75
• medra: pkp/pkp-lib#10796 only export ORCID if verified medra#39

[kaitlinnewson]

@ewhanson and @bozana, in cases where the downstream schema doesn't support indicating if an ORCID has been authenticated, do you think it makes sense to exclude the ORCID from the export?

[bozana]

I think we could always only consider the authenticated ORCID IDs if the third party does not support the differentiation, also because in 3.5 we will not allow the ORCID IDs to be edited or manually entered any more, so to move even more towards it...

[bozana]

@kaitlinnewson, could you maybe also list the other affected plugins or put this task also to this issue #9912 ?