title: Architecture for Authentication/Authorization of Mobile and Web Users
body: <p>This seems to be a reoccurring problem for me as I seem to gravitate around mobile applications the last few years. I want to authenticate and authorize mobile users in addition to web users. I need to make this seamless enough so that users can ease into having a web account without causing interruption to their data. I want the solution to be architectural in topic, not specific to any language/framework.</p>
  
  <p><strong>Requirements/Assumptions</strong></p>
  
  <ol>
  <li>Mobile users must be able to use the native application without a login, including for contributing content (marking favorites, uploading photos, etc).</li>
  <li>Mobile user should be securely and uniquely authenticating to the web service even without specifying account credentials.</li>
  <li>Mobile user may have multiple devices, which will be unaware of each other.</li>
  <li>Mobile user should be able to Register/Login, which should roll in any content into the account's ownership. This "synchronization" should occur with each account that is subsequently logged in.</li>
  <li>It should not matter whether an account was created on mobile or web.</li>
  </ol>
  
  <p><strong>Architectures Considered</strong></p>
  
  <ol>
  <li><strong>NO SHIRT, NO SHOES, NO LOGIN = NO CONTRIBUTION.</strong> Require login to contribute content of any kind. This prevents the need to "synchronize" device accounts with a master account. Simply require a single username/password + tokens in order for devices to login. Server objects: User, Role</li>
  <li><strong>Multi-device self-authentication.</strong> Server negotiates with device and hands it credentials which the device stores. Each device self-authenticates and is associated with an anonymous account until Register/Login occurs. If Register occurs, anonymous account is converted into known account. If Login occurs, content from anonymous account is moved over to known account and then thrown away. Devices that lose the self-authentication details will get new authentication details, and the previous anonymous account is abandoned (and then hopefully later thrown away) and not restorable since it was never converted into a known account. Server objects: User, Role, Device</li>
  </ol>
  
  <p><strong>What do you think is a good solution? One of these, or something else?</strong></p>