Out of the box authentication and authorization

[koenedaele]

Currently, Atramhasis does not come with a full package security implementation, leaving a lot of flexibility for the end-user at the expense of always having to do stuff to get some kind of security. Fairly simple for us, as we have our own implementation of the Pyramid security layer, but unhelpful for less skill end users. Similarly, our configuration of roles and permissions is very flexible, but hard to implement. So, we would like some sane out-of-the-box implementation.

Basic ideas for authentication

• We want a simple out-of-the-box authentication. This could be user/password, or something like using Google of Facebook.
• We want to allow users integrating with SAML

Basic ideas for authorisation

• We want to distinguish between four roles: admin, editor, contributor, reader, public
• We want to be able to grant premissions per conceptscheme for reader, contributor and editor. A user can be have different permission for different conceptschemes. Admin is a general role that applies to the whole system. Public is a pseudo-role that is granted to all public (non-authenticated users).
• Public:
  • Has to all public conceptschemes, including hidden ones (minor schemes that do not get promoted in the UI)
  • Can read a conceptscheme
  • Can read the list of conceptschemes, seeing all conceptschemes they have access to
• Reader:
  • Has access to all public conceptschemes and one or more private ones
  • Can read a conceptscheme
  • Can read the list of conceptschemes, seeing all conceptschemes they have access to
• Contributor:
  • Has read access to all public conceptschemes and conceptschemes they have contributor permission
  • Can contribute to conceptschemes they have contributor permission on
  • Can do all the things a reader can do
  • Can sugges new concepts (a feature that doesn't currently exist)
  • Can add comments to existing concepts
  • Can see all comments
• Editor:
  • Has read access to all public conceptschemes and contributor access to all conceptschemes they have contributor permission for
  • Can edit conceptschemes they have editor permission on
  • Can do all the things a contributor can
  • Can add new concepts to a conceptscheme
  • Can edit concepts in a conceptscheme
  • Can edit the conceptscheme information
  • Can remove concepts from a conceptscheme
  • Can NOT remove a conceptscheme
• Admin:
  • Has editor permissions on all conceptschemes
  • Can add new conceptschemes
  • Can configure conceptschemes
  • Can import data into a conceptscheme (eg. from a SKOS file, currently not implemented)
  • Can delete a conceptscheme
  • Can grant or revoke permissions to users

Possible libraries

• https://fizyk.dev/pyramid_fullauth/index.html
• https://yosaiproject.github.io/yosai/

Questions

• Do we actually want private conceptschemes? Right now we have public and hidden, but not private. That would mean having URI's that can't be accessed without authentication, even for services. Might be a bit of hassle and I'm not sure it's ever beneficial to hide something like a concept in a thesaurus? Apart maybe from draft concepts, but that seems more like something for Allow versioning a conceptscheme #927 ?