-
Notifications
You must be signed in to change notification settings - Fork 8
Security
chrisala edited this page Oct 18, 2023
·
4 revisions
Users of MERIT (and BioCollect) are authenticated using the OpenID Connect (oidc) protocol with the authorization code flow. The implementation is via the ala-auth-plugin which uses the pac4j library to implement the authentication flow.
See openid.net for an explanation of the OpenID Connect protocol.
Access control in MERIT is implemented via a combination of roles and an access control list (ACL) stored in ecodata.
MERIT supports the following roles:
| Role | Description |
|---|---|
| ALA Admin | Provides full access to all MERIT functionality |
| FC_ADMIN | Provides access to grant/project management functions as well as the ability to customise the home page, email templates and access to all reports and data downloads. |
| FC_OFFICER | Provides access to grant/project management functions |
| FC_READ_ONLY | Provides read only access to project data, normally assigned to auditors |
| Project/Grant manager | Access to approve / return project reports for a specific project. Only users with the Global FC_OFFICER role can be assigned this role on a project |
| Project admin | Access to edit data for a specific project as well as submit reports and assign project access |
| Project editor | Access to edit data for a specific project |
Every project in MERIT has an access control list which records the roles each user has for that project.