Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of jchris@gmail.com designates
 209.85.221.181 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=V8z0TnJDo7QteUlhzD00+dPjg7bXafGv9tSvgxkP8XvejBzudM9+R1BES38z3R67j5
         oi59vnPqVGNvAQAkgXzPb+eMbm45rtKDivipUz9BGyQqPGHH/fO04m/Q5mNATck46SQI
         GvEQn9QdEIQAhVMz2GNilGf4zJBHJjxoR27L0=
MIME-Version: 1.0
Sender: jchris@gmail.com
In-Reply-To: <b7cd8ed11002020657o52a39d94wc8be7a2c2f3e038@mail.gmail.com>
References: <b7cd8ed11002020657o52a39d94wc8be7a2c2f3e038@mail.gmail.com>
Date: Tue, 2 Feb 2010 09:36:42 -0800
Message-ID: <e282921e1002020936lbcb09e9x8d56a2a05a14ce68@mail.gmail.com>
Subject: Re: [patch] proxy authentificationn handler
From: Chris Anderson <jchris@apache.org>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 2, 2010 at 6:57 AM, Benoit Chesneau <bchesneau@gmail.com> wrote=
:
> Hi all,
>
> I've just pushed on jira my proxy authentification handler. This code
> is used behind aimpl.org and works well.
>
> https://issues.apache.org/jira/browse/COUCHDB-636
>
> This handler allows creation of a userCtx objec from a user
> authenticated remotly. The client just pass specific headers to
> CouchDB and the handler create the userCtx. Headers name can be
> defined in local.ini. By thefault they are :
>
> * X-Auth-CouchDB-UserName : username, (x_auth_username in
> couch_httpd_auth section)
> * X-Auth-CouchDB-Roles : user roles, list of roles separated by a
> comma (x_auth_roles in couch_httpd_auth section)
> * X-Auth-CouchDB-Token : token to authenticate the authorization
> (x_auth_token in couch_httpd_auth section). This token is an hmac-sha1
> created from secret key and username. The secret key should be the
> same in the client and couchdb node. secret key is the secret key in
> couch_httpd_auth section of ini. This token is optional if secret key
> isn't defined.

This token should be optional even if the secret key is defined (the
secret is defined by default but people might want to skip the headers
signing stuff if they are in a simple environment.)

>
> What do you think about including it in 0.11 ?

This is fine by me -- the patch is pretty isolated, and disabled by
default, so I don't see it causing any instability.

>
> - beno=EEt
>


--=20
Chris Anderson
http://jchrisa.net
http://couch.io