Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of skippy.hammond@gmail.com
 designates 209.85.216.185 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=S/zwaq6lExtUR/t9U7JMTQ5txwRvE8/hFG3w9szzleErtjv1pQ+x9G+zhOm/PWP6MU
         4yCEG5sGoT3rG0LPYPL6ZJel4HqIj5QRt6UtCtWYfZ8SLVSOoXBhT+CkkcXtLZXaCKig
         bkBsD8jBHjSHHMnnNDdDLpP7Cn0ZhZzUv0IlM=
Message-ID: <4A44331A.8040901@gmail.com>
Date: Fri, 26 Jun 2009 12:31:54 +1000
From: Mark Hammond <skippy.hammond@gmail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US;
 rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2
MIME-Version: 1.0
To: dev@couchdb.apache.org
Subject: Re: CouchDB Authentication and Authorization
References: <52664B06-2181-43F1-8E77-BE7D22680902@apache.org>
In-Reply-To: <52664B06-2181-43F1-8E77-BE7D22680902@apache.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 26/06/2009 1:02 AM, Jan Lehnardt wrote:
> A an example authentication client request
>
>    | client |  ---> | http request with credentials |  ---> |
> authentication handler |  ---> | lookup in authentication handler
> specific view in `users` database |  ---> | grant or deny access, set
> role |

If you intend support Windows NTLM authentication, there are a couple of 
things that may, or may not, complicate this:

* NTLM is based on a series of 'challenge/response' pairs; the client 
issues a request, the server responds with a 404 and a 'token' in the 
headers, the client re-requests with a token based on the server's 
token, the server responds yet again with 404 and a new token, then 
finally the client's next request works.

* NTLM is connection-based.  Once the connection is closed you must 
re-do that dance.  It is not possible to persist anything beyond the 
life of the connection which you can use on a subsequent connection. 
Therefore, the dance described about must also be performed on the same 
connection.

Hoping this is relevant,

Mark