Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of bchesneau@gmail.com
 designates 209.85.215.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAJNb-9pz6S4CjS2LPyVZSR77qZoy53Ws-ku5HoCHKEYA8HrLDg@mail.gmail.com>
References: 
 <CAN4bnkxnVo88C204CVx91onbzUOvV2SB1JDKH1kokpZg6ZKr=g@mail.gmail.com>
	<CAJNb-9pu=rH12R8WJrXahTSt9-=M3iNwtbarYUho5t23xqETDw@mail.gmail.com>
	<CAJNb-9pz6S4CjS2LPyVZSR77qZoy53Ws-ku5HoCHKEYA8HrLDg@mail.gmail.com>
Date: Thu, 1 Sep 2011 20:14:22 +0200
Message-ID: 
 <CAJNb-9qBwzcE_sN8TFPrNeV_00bsqckkf1r3cX2F94AEnk6s9g@mail.gmail.com>
Subject: Re: Noob security question
From: Benoit Chesneau <bchesneau@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

bump

On Thu, Sep 1, 2011 at 5:41 PM, Benoit Chesneau <bchesneau@gmail.com> wrote=
:
> forwarding this thread. Maybe we could make things a little more intuitiv=
e here?
>
>
> ---------- Forwarded message ----------
> From: Benoit Chesneau <bchesneau@gmail.com>
> Date: Thu, Sep 1, 2011 at 3:02 PM
> Subject: Re: Noob security question
> To: user@couchdb.apache.org
>
>
> On Thu, Sep 1, 2011 at 2:30 PM, Neil Gibbons <gibbons.n@gmail.com> wrote:
>> Hey,
>>
>> Posted this on stackoverflow.com too, (
>> http://stackoverflow.com/questions/7260971/couchdb-iris-couch-noob-secur=
ity-question),
>> which
>> led me to the mailing list.
>>
>> Basically I've been playing with Iris Couch but have come across some
>> unexpected behavior.
>> I have the following _security set against a test db:
>>
>> {"admins":{"names":["neil"],"roles":["admin"]},"readers":{"names":["gues=
t"],"roles":["guest"]}}.
>>
>> When I created a new server admin via Futon:
>>
>> {"_id":"org.couchdb.user:test2","_rev":"1-084965a94ea3d7a24116f33245a0ef=
95","name":"test2","type":"user","roles":[]}
>>
>> This user can read from my test db?
>>
>> curl -X GET http://test2:test@neil.iriscourchdb.com/test
>> curl -X GET http://test2:test@neil.iriscourchdb.com/test/_all_docs
>>
>> Because neither this users name nor role appear in the _security documen=
t
>> I'd expect them not to be able to be authorized?
>>
>>
>> Neil
>>
>
> I'm also confused. What it happen anyway is:
>
> - The admin created via futon, create an admin user in the ini file.
> - This user have admin rights and can see/manage all the dbs
> - The =A0confusing part: a user document is also created but have empty r=
oles.
>
> Imo rather we create all the users in the user db with appropriate
> roles, or "super" admins shouldn't appear in it. That's worth a
> discussion.
>
> - benoit
>