Acegi

We'll use Acegi for authentication and authorization.

It uses web filters for authentication and url based authorization, AOP for method or instance based authorization.

Supports several ways of authentication wich can be plugged in as needed through configuration.

Reference documentation. 

Definitions

Some concepts are 

• Role: A application level permission, eg. ROLE_ADMINISTRATOR
• ACL: pairs with (object class, object instance id, user id, permission - customizable -)

Acegi provides three places where to enforce security

• URLs - urls can be protected by defining the url pattern (Ant or regexp) in the configuration. eg. */secure/* requires ROLE_ADMINISTRATOR
• Method invocation - eg. MyClass.removeUser() requires ROLE_ADMINISTRATOR
• Object Instance - using ACLs, individual instances can have different permissions for each user

Authentication

By default Continuum will authenticate against the DB bundled through JDO as in 1.0.x. It'll get usernames, passwords and user roles from there.

See the Reference documentation for other possible authentication options.

Authorization

Project level

For each project we'll need to keep permissions for each project and user. ACLs can be used to implement this functionality, see Acegi Domain ACLs

Possible permissions

• Show - see the project and project info
• Edit - edit the project info
• Delete - delete the project
• Build - force a build

We have also add/edit/delete operations over

• build definitions
• notifiers

but i think they can be associated to the corresponding project, if you have edit permissions over the project you can do anything with build definitions and notifiers, and if you have show permission over the project you can see also notifiers and build definitions.

User level

Users must be able to edit themselves

I think this can be achieved with the Run As Authentication Replacement

Special users

We'll keep the roles from 1.0.x for the portions that require role authorization

• addProject
• manageConfiguration
• manageSchedule
• manageUsers 

We can protect those pages with URL authorization using user roles.