citizen-cyberscience-centre/pybossa — Issue #42: Authentication & Authorization
Author: teleyinex
Created: 2012-02-01 08:51:44+00:00
State: open
Labels: discussion, priority.high

It is important to discuss the minimum requirements that PyBossa will have according to authentication and authorization.

**Authentication**: for the moment there is a basic authentication method, that allows users to create an account, sign in and sign out. Everything is implemented using Flask-Login.

**Authorization**: it is mandatory to identify which actions will be valid for different types of users. For the moment I think that the following roles will be possible:

* **Project managers**: these users will be able to administer all the registered applications within the service. Thus, they will be able to create, update and delete applications, as well as all their associated data.
* **Users**: these type will be allowed to participate in different applications registered in the system, as well as creating their own applications thanks to the UUID API key which is generated when you register an account. For these reasons, these users will be able to: create, update and delete their **own** applications as well as the associated data (tasks of the applications created by the user).
* **Anonymous**: it could be interesting to allow anonymous contributions to different applications. Thus, there should be an option within the creation of the applications to allow anonymous contributions. Anonymous contributions could be very valuable as it will help new users to try the system and get involved without all the problems of registering, at first, a new account. These type of accounts will allow to play directly and contribute as in Wikipedia or GalaxyZoo.