User rights management?

[portnov]

In order for batchd to be used in multi-user environment, it needs to have some sort of user rights management / access control system:

• Some users are super-admins
• Some users can do anything with specified queues only
• Some users can only put jobs to specified queues only
• Some users can only view status of some queues.

It seems we have to have "users", "groups" and ACLs with permissions listed above.

For the auth, we can use two approaches:

• basic HTTP user/password auth
• HTTPS auth with client certificate checking.

For both approaches, a question of how to store credentials secure is actual. It would be good to delegate this functionality to specialized system, but usage of system like RADIUS or kerberos seems too complex for now.

[portnov]

About authentication: the following options will be available:

• basic HTTP auth. Enabled by default. Passwords are stored as SHA-256 hashes with salt.
• "X-Auth-User" header. Provided user name is accepted without further auth. Disabled by default. To be enabled in case when authentication was done externally. Usable for example when client certificate is checked by nginx.
• No auth. In this mode all users are superusers. This can be used on localhost. Disabled by default.

[portnov]

Implemented.