Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of jrhuggins@gmail.com
 designates 209.85.200.175 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=ZdlDLm6A7GxWl71+hczr2iQsi6VcZac4g5oisELROvZ/GgyURas9ApxZRfdgDKnV4Q
         Eg74xvz84r0zDNIjZm/NGsuFiqQ89aL9M4iTvbLaY9kg0udBTy43/RfVDfRpNdNm7+yc
         qmNbgMr8T7PQhi5XtF51JjCGAWBpp76ybLPFE=
MIME-Version: 1.0
Sender: jrhuggins@gmail.com
In-Reply-To: <a34226890902210328x75041fa2w1af42a2289c9306d@mail.gmail.com>
References: <a34226890902210328x75041fa2w1af42a2289c9306d@mail.gmail.com>
Date: Sat, 21 Feb 2009 07:40:25 -0600
Message-ID: <53b9568a0902210540i59b31c79p3d794c8ec4e3179@mail.gmail.com>
Subject: Re: Managing access
From: Jason Huggins <jason@jrandolph.com>
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Sat, Feb 21, 2009 at 5:28 AM, Jyrki Pulliainen
<jyrki.pulliainen@gmail.com> wrote:
> CouchDB site talks about managing user access on database (Admin,
> read, update), but I can't find any documentation about this feature.
> Can someone pinpoint a page describing the built-in access management?


http://wiki.apache.org/couchdb/Apache_As_a_Reverse_Proxy

You could use Apache as a reverse proxy to your couchdb server. At the
Apache layer, you can then add an authentication scheme. The above
link doesn't have the authentication bits shown, but you can find out
how to do that reading ordinary Apache documentation.

Authorization (i.e. "can user 'a' edit database 'b'?") is a bit more
tricky than simple authentication (i.e. "is this user 'a'?"). Until
this kind of thing gets baked into CouchDB (or someone documents how
they did it!), you'll probably have to roll your own solution.

In my setup, I use Apache to enforce SSL encryption. I then use Django
as my authentication and authorization engine, where I first require
all connections to be authenticated with Basic Auth.  Then, Django
allows  'regular' users to only to edit their own databases, and
'admin' users to edit any database.

Alas, I have no page to point to yet that shows you how to do the
Django part. I will say, though, that the hardest bit was making sure
Django properly proxied all the HTTP headers to and from the CouchDB
backend. However, the CouchDB unit tests in Futon were invaluable and
made developing my auth proxy easier.

Cheers,
Jason Huggins