Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of thadguidry@gmail.com
 designates 74.125.78.26 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=j1UtW8GFDlDUWidinw74iBZxAn/2FVoz8jhisQjFwtwaW0/YlUffdzzOcjPN5KT3df
         6piiTFm7mTBScaQgUqm0IF3A1IODBRg1HBHDmd4qytCnppG79keGdUElJXx9Trul/hiK
         kKY+zjDC3/HYklKPh8Zd22Sop+BaAaEGCHxCg=
MIME-Version: 1.0
In-Reply-To: <4A57D3D4.8090800@gmail.com>
References: <e282921e0907092308v463e842dy535abb012e7c76e7@mail.gmail.com>
	 <4A57405C.604@gmail.com>
	 <b7cd8ed10907100722n2f66a101y12bdcb01cdfbd291@mail.gmail.com>
	 <e282921e0907100950r4b5cd6b4h493e122becc30cc@mail.gmail.com>
	 <4A57D3D4.8090800@gmail.com>
Date: Fri, 10 Jul 2009 19:14:39 -0500
Message-ID: <a8b720180907101714h7f286284tcbe6e117051a2d10@mail.gmail.com>
Subject: Re: Cookie Auth
From: Thad Guidry <thadguidry@gmail.com>
To: dev@couchdb.apache.org
Content-Type: multipart/alternative; boundary=0015174bea248dbe97046e62f95f

--0015174bea248dbe97046e62f95f
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

I myself would like to see OAuth support down the road.  Also there's
numerous OASIS standards that could be applied with a little help.

Anyone else?
-THAD

On Fri, Jul 10, 2009 at 6:50 PM, Mark Hammond <skippy.hammond@gmail.com>wrote:

> On 11/07/2009 2:50 AM, Chris Anderson wrote:
>
>  One man's feature creep is another's requirement... I try to keep a
>> level head about CouchDB features by leaving out the ones that every
>> application will do differently. If we can make a session handler that
>> CouchApps all use by default, it will take an entire territory of pain
>> away from application developers. If we leave it out, everyone will
>> implement it differently and that starts to be it's own problem.
>>
>
> I agree with the sentiment, but do wonder if this session handler really
> will be a handler everyone can use by default.  My experience with web based
> authentication has been that the biggest challenges are *integration* with
> existing auth schemes and concepts of 'session'. Integration directly with
> an external auth system (eg, NTLM), or with existing applications (eg,
> working with something like Zope's concept of security/roles) quickly means
> that one size rarely fits all in sophisticated environments.
>
> So while I don't question the utility of simple auth handlers (I agree many
> people will use them *first* while determining their real requirements or
> for simple environments), I still believe the focus should be on ensuring
> all the right hooks are in place so people can contribute or write handlers
> suited to a specific purpose, rather than trying to cover all these
> 'specific purposes' in a core module. Offering simple cookie or http-based
> auth scheme handlers as a 'sample' handler makes more sense and implicitly
> acknowledges we can't predict their specific use case.  Isn't that (from
> 1000 feet above) how Apache itself manages auth?  It is how IIS does.
>
> This is obviously just my opinion though - please take it for what it cost
> you ;)
>
> Cheers,
>
> Mark
>

--0015174bea248dbe97046e62f95f--