Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of stefan.karpinski@gmail.com
 designates 209.85.146.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=M+M2LstZ7PEdKkvSBayzfGx8N2eyFDi4zTpBYuzaiA3PwWGtS3s60VGXje/MTkW9IQ
         mqBjg7+IXT9qVFW/ZJpIU/5656FcDCnIZ3oFkNwZC8py4whDEYhm6V2JKHfCFH58qT3/
         z+Yxv5gk2+SkbwZWisy2lqXWmvyoK/A0uQCOY=
MIME-Version: 1.0
In-Reply-To: <d4bc1a2a0902201516o1228b98cka92ea78efbb8f32b@mail.gmail.com>
References: <e282921e0902201324u75b6c462m7a5e6dc0deab1796@mail.gmail.com>
	 <d4bc1a2a0902201351y6fb9744bm69753091a76e89b2@mail.gmail.com>
	 <e282921e0902201501v4430670ajc0b7297fdb2d179a@mail.gmail.com>
	 <d4bc1a2a0902201516o1228b98cka92ea78efbb8f32b@mail.gmail.com>
Date: Fri, 20 Feb 2009 15:48:41 -0800
Message-ID: <d4bc1a2a0902201548k38ea1d49t4bd3cbcf18f2b483@mail.gmail.com>
Subject: Re: User Auth
From: Stefan Karpinski <stefan.karpinski@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Thoughts (just brainstorming here):

I think it makes sense to separate authentication and permissions.
Pure authentication is just about verifying that the user is who they
claim to be. Permissions are about deciding which users are allowed to
see or do what. Cleanly separating is good: ideally you should be able
to completely swap out your authentication mechanism, switching from,
say basic auth to SSL + digest auth, and keep the application logic
about who gets access to what completely unchanged. For example,
Apache accomplishes this by doing whatever authentication it's doing
and then passing the REMOTE_USER environment variable
(http://httpd.apache.org/docs/1.3/misc/FAQ-F.html#remote-user-var)
with the authenticated user name. Whatever CGI or variant thereof
(FCGI, etc.) then just does whatever it sees fit to do with that user
name.

Also, authentication is typically slow: even hashing a user/pass combo
takes some CPU =97 this is not something that you want to have done on
every request. That's why the notion of user sessions exists (at least
from the security perspective; there are other notions of session).
That argues for having the CouchDB server process manage
authentication and letting the application developer define custom
functions for deciding whether (user,resource) pairs are acceptable or
not. I.e. the CouchDB process somehow validates that the request is
coming from someone who has provided adequate proof that they are who
they claim to be, via HTTP basic/digest auth or whatever. Then the
application can just decide whether the pre-authenticated user is
allowed to access a particular resource.

More thoughts coming...

On Fri, Feb 20, 2009 at 3:16 PM, Stefan Karpinski
<stefan.karpinski@gmail.com> wrote:
>> I wish I could say we've got such a clear picture of it.
>
> Good to get in on the planning stages!
>
>> The easiest way to cleave the knot is probably to rely on 3rd party
>> auth like OpenID or OAuth (I don't quite know which parts of which
>> we're interested in).
>
> OpenID is great, but I don't think it's viable to force people to use it.
>
>> Identifying users as URLs would make things easier on application devs, =
I think.
>>
>> If every app will need to implement something like this, it makes
>> sense to me to have the CouchDB host manage the session, even if apps
>> can keep their own user-preferences docs if they wish. Being logged
>> into all the apps on a node seems a lot more intuitive than having to
>> create accounts for each one. If the user is identified with a URL,
>> then preferences etc can be replicated to other hosts while everything
>> "just works".
>
> I think that nailing this problem would go a *long* way towards making
> CouchDB popular not only for it's nice distributed properties and
> such, but also because would make writing modern web apps drastically
> easier. Because literally *every* non-trivial web application needs to
> do user authentication. Having it _just work_ without having to worry
> about it is a massive win. Moreover, if the database was actually
> aware of application-level authentication and could enforce it, then
> it would increase the security of CouchDB-based web apps. Errors in
> business logic would be much less likely to accidentally expose data.
> How easy is it to forget in Rails that you need to filter the objects
> in some table by the user_id field?
>
> On Fri, Feb 20, 2009 at 3:01 PM, Chris Anderson <jchris@apache.org> wrote=
:
>>
>> On Fri, Feb 20, 2009 at 1:51 PM, Stefan Karpinski
>> <stefan.karpinski@gmail.com> wrote:
>> > I'm not entirely clear what level of user auth is being addressed here=
.
>> >
>> > On the one hand, there's the system-level sense of a user that traditi=
onal
>> > databases have: i.e. something equivalent to a UNIX user account, but =
in the
>> > database, which has to be created by an admin and can then be granted
>> > table-level access and various administrative rights (create user, cre=
ate
>> > database, create table).
>> >
>> > On the other hand, there's the application-level sense of user: i.e. a
>> > record in a users table, which is given access or not given access to
>> > database records via the web application stack at a higher level, whic=
h sits
>> > between the database and the client's web browser (or whatever).
>> >
>> > The current CouchDB notion of admin user seems to fall into the former
>> > category, while what most applications need falls into the latter cate=
gory.
>> > One irritation of all application-level authentication schemes I've ev=
er
>> > encountered is that the database does not give you any support for
>> > application-level user auth. If CouchApps are really going to be feasi=
ble,
>> > CouchDB (clearly) needs to solve the application-level user authentica=
tion
>> > problem.
>> >
>> > My sense is that the goal is to somehow merge the two senses of databa=
se
>> > user, and thereby cleave the Gordian knot in two. Is that sense correc=
t?
>>
>> I wish I could say we've got such a clear picture of it.
>>
>> The easiest way to cleave the knot is probably to rely on 3rd party
>> auth like OpenID or OAuth (I don't quite know which parts of which
>> we're interested in).
>>
>> Identifying users as URLs would make things easier on application devs, =
I think.
>>
>> If every app will need to implement something like this, it makes
>> sense to me to have the CouchDB host manage the session, even if apps
>> can keep their own user-preferences docs if they wish. Being logged
>> into all the apps on a node seems a lot more intuitive than having to
>> create accounts for each one. If the user is identified with a URL,
>> then preferences etc can be replicated to other hosts while everything
>> "just works".
>>
>> Thanks for the feedback!
>>
>> --
>> Chris Anderson
>> http://jchris.mfdz.com
>