Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Sender: J Chris Anderson <jchris@couch.io>
From: J Chris Anderson <jchris@apache.org>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: multipart/alternative; boundary=Apple-Mail-27--74076299
Subject: Re: Issues while using couchdb http cookie auth
Date: Thu, 5 Aug 2010 10:11:57 -0700
In-Reply-To: <AANLkTi=iLD9p9=oeS3KGrt=oqnFpbjfveVNp7t_KdG37@mail.gmail.com>
To: user@couchdb.apache.org
References: <AANLkTi=iLD9p9=oeS3KGrt=oqnFpbjfveVNp7t_KdG37@mail.gmail.com>
Message-Id: <EF793752-CF43-4972-B4A8-BC50B4E1CD1D@apache.org>

--Apple-Mail-27--74076299
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


On Aug 5, 2010, at 7:11 AM, Mahendra M wrote:

> Hi,
>=20
> I was trying to setup and use couchdb http cookie auth. I could
> not find any "official" documentation for the same. A bit of searching =
around
> gave me these.
>=20
> 1. http://pierrel.posterous.com/securing-couchdb (seems new)
> 2. http://www.mail-archive.com/dev@couchdb.apache.org/msg02631.html =
(2009)
> 3. =
http://www.jasondavies.com/blog/2009/05/27/secure-cookie-authentication-co=
uchdb
>=20
> My requirement is this.
> * Have one db with user related docs.
> * The key of the doc is the userid
> * The sha1 hashed password for each user is stored in his doc.
> * I want to issue cookies based on a userid and password posted to =
couchdb.
>=20

This is pretty much how the built-in auth works. Jan is working on a =
document here:

http://wiki.couchapp.org/page/authn-preview

The other thing to do is just use the signup and login buttons on Futon =
to do the same thing. Look in the lower right corner of =
http://localhost:5984/_utils/

I have code here that also does signup and login (using the jquery =
plugin that ships with couch)

=
http://github.com/couchapp/couchapp/blob/master/vendor/evently/account/doS=
ignup.js


> Originally, I was trying on writing my own show function to do an
> auth. Then I saw
> that couchdb itself has support for doing this.
>=20
> The methods discussed in the above thread(s) are really good and I =
wanted to
> try it out. However, it is not working even after following both the =
examples.
>=20
> I keep getting an error
> {"error":"unauthorized","reason":"Name or password is incorrect."}
>=20
> The debug logs also don't give out much information.
>=20
> Looks like I have not set up things properly and the above docs are a =
bit
> confusing. Also, could not find anything on the couchdb wiki.
>=20
> So, I wanted to check if there is any other documentation on how to =
make
> use of http cookie auth.
>=20
> Or has anyone tried and got it working ?
>=20
> In link(1), it explains how to setup a single auth scheme for a =
couchdb node and
> making use of /_session to get a cookie.
>=20
> In link(2), it looks like adding _login and _logout handlers to each
> db. Does this
> mean that each db can have it's own user/password sets ? Also, what =
parameters
> must be passed to _login ? Also, this says that the "users" view
> values must have
> a member "password" whereas the previous link asks for a member =
"password_sha".
>=20
> Which is the correct approach to follow ? or are both valid ?
> I am a bit confused as of now :-)
>=20
> Regards,
> Mahendra
>=20
> http://twitter.com/mahendra


--Apple-Mail-27--74076299--