Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Sender: J Chris Anderson <jchris@couch.io>
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
Subject: Re: Best performing login implementation?
From: J Chris Anderson <jchris@apache.org>
In-Reply-To: <6161665A-8BBB-4441-9FE9-37918CE35446@gmail.com>
Date: Mon, 6 Sep 2010 09:38:58 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <3DAC56D6-6DB8-4A3E-8A36-453E42AE3AF6@apache.org>
References: <AANLkTikh=56TEWh=OkPA8o-NiRsumcVrdRFeF4_nZ9cv@mail.gmail.com>
 <33F12002-C2C7-4F38-9010-F4B168D688A3@gmail.com>
 <AANLkTimA7cawgxvDK+oV+X=srPAcP=pfKOQoyEYjLqaU@mail.gmail.com>
 <DF7FAEBF-2E6A-43AE-ABCA-7F030CE346C9@apache.org>
 <6161665A-8BBB-4441-9FE9-37918CE35446@gmail.com>
To: user@couchdb.apache.org


On Sep 6, 2010, at 8:50 AM, Wout Mertens wrote:

> On Sep 6, 2010, at 17:24 , J Chris Anderson wrote:
>=20
>> Also it is worth noting that CouchDB has a builtin authentication =
system that gets this right, and you might just be able to piggyback on =
it, depending on your application:
>>=20
>> =
http://blog.couch.io/post/1027100082/whats-new-in-couchdb-1-0-part-4-secur=
ityn-stuff
>=20
> So the security model is:
> - Admins can do everything on all local databases
> - Readers can read the entire database
> - Writes can have any model you like with validation functions
>=20
> So if you want to segment your database readers you have to segment =
your databases.
>=20

Yes.

> Furthermore, if you would like to use LDAP authentication, you'd have =
to use an LDAP-to-OAuth server.
>=20

It should be a very simple patch to add new Erlang authentication =
handlers for things like LDAP, Kerberos, etc. That might be simpler than =
adding a bunch of glue to speak OAuth.

> Correct?
>=20
> Wout.