Mailing-List: contact couchdb-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: couchdb-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of cmlenz@gmx.de designates
 213.165.64.20 as permitted sender)
Message-Id: <E5C787F4-00C3-467D-92A7-822954C3B88A@gmx.de>
From: Christopher Lenz <cmlenz@gmx.de>
To: couchdb-dev@incubator.apache.org
In-Reply-To: <3944C148-CC00-4204-B800-5C7221273C21@gmail.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v919.2)
Subject: Re: CouchDB 1.0 work
Date: Sat, 10 May 2008 17:35:28 +0200
References: <6A14F004-1449-4FC9-A2EE-47BC1CAF9FED@yahoo.com>
 <1833C7F3-E82D-4BDE-B4EB-4890D6FC2665@gmx.de>
 <3944C148-CC00-4204-B800-5C7221273C21@gmail.com>

On 10.05.2008, at 16:47, Damien Katz wrote:
> On May 10, 2008, at 10:09 AM, Christopher Lenz wrote:
>
>> On 28.04.2008, at 18:27, Damien Katz wrote:
>>> Here are my thoughts on what we need for before we can get to  
>>> CouchDB 1.0. Feedback please.
>>>
>>> Must have:
>> [...]
>>> Security/Document validation: We need a way to control who can  
>>> update what documents and to validate the updates are correct.  
>>> This is absolutely necessary for offline replication, where  
>>> replicated updates to the database do not come through the  
>>> application layer.
>> [...]
>>> Don't Need:
>>>
>>> Authentication. We can go to 1.0 without authentication, relying  
>>> instead on local proxies to provide authentication.
>>
>> So how would we provide authorization without authentication? There  
>> needs to be some way to identify who's making a request, and if we  
>> plan to rely on proxies for that, those proxies need to provide a  
>> way to pass on the authentication results (e.g. REMOTE_USER). I  
>> suspect they don't do that, but I may be wrong.
>
> I'm thinking the proxy server will authenticate the users  
> credentials in the request HTTP header, then let the request pass  
> normally to the CouchDB server. If it can't authenticate, then it  
> rejects the request.

Yeah, but how will CouchDB be able to use the authentication results  
to provide the "Security/Document validation" feature?

As far as I know, the proxy will keep the auth info to itself, and the  
request will look like a standard anonymous request to CouchDB. I  
*think* if we don't implement authentication, we can not implement  
authorization/security for document validation.

Cheers,
--
Christopher Lenz
   cmlenz at gmx.de
   http://www.cmlenz.net/