Collect list of requirements for autorisation service

[muhrin]

As pointed out by Jiawei, it would be good to document the requirements for the authorisation service. This component will facilitate the 'data transaction clearing and reporting system' by making authorisation decisions about who can access which datasets. Initially we can use this ticket to brainstorm and then break off individual requirements into their own tickets.

Here are some ideas of what we may think to support (feel free to edit):

• [ ] Based on a user token (generated when a user logs in) the system will grant or deny access to a data source or service
• [ ] Data/service owners should be able to configure who has access and who is denied
• [ ] Authorisation should be granular, perhaps to the level of groups of users (e.g. free tier users, premium users, users who bought a particular data package, etc)
• [ ] The system should have (or be able to be connected to) a logging service that logs authorisation requests and changes in a user's groups, etc
• [ ] The authorisation system should provide a python interface for integration with the graphical and REST interfaces
• [ ] DOME administrators need to be able to see all groups and users, and change their authorisation rights
• [ ] When a user requests access to a data source or service the owner is asked (by email) to accept or deny this request (not that this may be functionality that is part of the authorisation service, or implemented by our backend)
• [ ] The service should be deployable via automated scripts (e.g. a docker container)
• [ ] The service must have the ability to be backed up using scripts
• [ ] The service should have decent documentation so a new developer can take over adding features/fixes