Authentication & Access Control for Canuckduck

1. Purpose

This document defines the authentication process and access control rules for Canuckduck, ensuring secure login flows, user role management, and controlled data access within the platform.

2. Authentication System Overview

  • Canuckduck uses OpenLDAP for centralized authentication and access control.
  • Users must authenticate to access Flightplan, Consensus, and specific functions within Pond.
  • Authentication is required for posting, voting, and accessing structured decision-making tools.

3. User Roles & Permissions

Canuckduck operates with a role-based access control (RBAC) model, ensuring that users only access features relevant to their role.

User Roles:

  1. Guest (Unauthenticated Users)
    • Can view public Pond discussions.
    • Cannot vote, post, or access Flightplan/Consensus.
    • Redirected to login page if trying to interact.
  2. Standard User
    • Can participate in Pond discussions and post new topics.
    • Can engage in Flightplan discussions but cannot create official proposals.
    • Can vote in Consensus, provided they have engaged with the issue beforehand.
  3. Flightplan Contributor
    • Can submit structured Flightplan proposals.
    • Can edit and refine solutions within Flightplan.
    • Must meet engagement requirements before proposing new solutions.
  4. Moderator
    • Can remove spam/inappropriate content from Pond.
    • Can flag discussions for escalation to Flightplan.
    • Can temporarily restrict users for violating platform policies.
  5. Administrator
    • Full system access, including user management, access logs, and policy enforcement.
    • Can override access restrictions if necessary.
    • Maintains system-wide security policies and integrations.

4. Login & Session Security

  • Two-Factor Authentication (2FA) is required for moderators and administrators.
  • Session expiration is set at 24 hours, requiring re-authentication for continued access.
  • Users who fail 5 login attempts are temporarily locked out for 15 minutes to prevent brute-force attacks.

5. Data Access Restrictions

  • Consensus Votes: Anonymized but verifiable within Canuckduck.
  • User Identity (Solidarity Component): Not linked to voting records to ensure privacy.
  • Geolocation Data (Stature Component): Used only for issue visibility but stored separately from user accounts.
  • Flightplan Proposals: Can only be edited by the original proposer and approved moderators.

6. Account Recovery & Password Reset

  • Users can reset their passwords via email authentication and security questions.
  • Admins can manually reset passwords if a user is locked out but cannot view old passwords.
  • Failed password recovery attempts trigger security logs for monitoring.

7. Implementation & Future Security Enhancements

  • OAuth 2.0 Integration: Future support for third-party logins (e.g., government-issued authentication, educational institution credentials).
  • Biometric Authentication: Under consideration for mobile access.
  • Enhanced AI-driven fraud detection: Flagging suspicious login patterns or bot activity.

8. Conclusion

This authentication and access control framework ensures secure, structured access to Canuckduck, maintaining privacy while allowing users to participate in governance discussions. Future security updates will continue to refine authentication processes as the platform scales.