Implement user authentication

[patateqbool]

Implementing some kind of user authentication would allow for some partitioning between users and projects so that not everyone is able to access everything on the server. Also, by introducing a permissions system, we could make a project read-only.

[SilverBut]

I have a version based on the client-side certificate. However, I will not open a PR until a fixed some stability and GUI issues.

[patateqbool]

Yes I saw your fork and your commits, it is indeed an option envisagable. The other option would be to create a web interface/Qt frontend to create accounts and manage permissions.
I'm not sure that the two features are mutually exclusive, we could implement both imho.

[SilverBut]

Now we have a config file, so adding a QT frontend is not hard. The problem is how to implement it, if not using certificate...

[NeatMonster]

I have a version based on the client-side certificate.

I think an username/password approach would be easier to manage. I like your idea to be able to use a custom PKI to authenticate the server, but I don't think it matches our needs for this feature.

[SilverBut]

I like your idea to be able to use a custom PKI to authenticate the server,
This is only a small part of the code.

Client-side certificate means the client needs to send its own certificate to server, and server will check if it's signed with an valid CA or it can be directly trusted. It is not used for auth the server.

And it still remains a problem about how to auth an user. Let's assume there already have some user authentication method, and the problem is: should SSL be forced if the method is applied? If not, we may need to have a strong design of the auth method. Or, we can just use something like basic authentication, since server can be trust.

[NeatMonster]

I know you implemented mutual authentication on your repo. I just meant that I can see value in authenticating the server using a custom certificate chain. But authenticating clients the same way might be very practical for large corporations, but way overkill for small groups of individuals.

You're right that we need to do authentication correctly if we allow SSL to be disabled though.

[NeatMonster]

I think this issue and #45 have the same end goal. We'll need some kind of mandatory SSL tunnel and some kind of user authentication. I'm closing this issue in favor of the other one (that I have also renamed).