Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
MIME-Version: 1.0
In-Reply-To: <E931D0FA-7841-401B-9733-16F2F5B0AA30@apache.org>
References: <CA+9HOACj30F6BfzOPVoEZjOBcBvOZBPqzGgmbVG6G7T-KFQJ6g@mail.gmail.com>
 <B80873F5-8191-4F36-B649-2B79009E91EC@medicmobile.org> <CA+9HOAAO_RD4C_6fFNofBeqFaOKqGoAb66HYUFA6izprJva_Tg@mail.gmail.com>
 <E10013C8-927B-4BC1-98F5-430778D3948D@medicmobile.org> <CA+9HOAAXynosg-rvoUSeOBvf14_9=0B5RX1OqKZCGrU41JQ-XA@mail.gmail.com>
 <E931D0FA-7841-401B-9733-16F2F5B0AA30@apache.org>
From: max <maxima078@gmail.com>
Date: Mon, 25 Sep 2017 12:45:50 +0200
Message-ID: <CA+9HOABctBp46YCQMC9=YsjSxDrONe_s8mkB3_eL1Ltq86RTZA@mail.gmail.com>
Subject: Re: User with _users admin Permissions cannot delete document
To: user@couchdb.apache.org
Content-Type: multipart/alternative; boundary="f403045f4c001f6fa7055a0143d7"
archived-at: Mon, 25 Sep 2017 10:46:00 -0000

--f403045f4c001f6fa7055a0143d7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thank you.

I'm gonna create a user admin and I'll use it from local service exposed to
the web with classic CouchDB auth.

Last question about 2.1, in fauxton I couldn't find a way to navigate
through document revisions (like the '' previous version '' button in
1.6.1). Is it still possible ?

Le 25 sept. 2017 11:31 AM, "Jan Lehnardt" <jan@apache.org> a =C3=A9crit :

> Stefan is correct that this is expected behaviour, but I=E2=80=99d reject=
 the
> notion that
> it is in any way recommended to not use the CouchDB user system. All you
> need to
> do is have a CouchDB admin user do the _users edits.
>
> Of course you can build your own system on top, but I wouldn=E2=80=99t re=
commend
> that.
>
> Best
> Jan
> --
>
> > On 23. Sep 2017, at 15:17, max <maxima078@gmail.com> wrote:
> >
> > Thank you for your answers I'll try with simple web services layer.
> >
> > Le 23 sept. 2017 3:14 PM, "Stefan du Fresne" <stefan@medicmobile.org> a
> > =C3=A9crit :
> >
> >> None that I know of no. Ideally it would just work, but I think editin=
g
> >> permissions for _users is effectively deprecated at this point.
> >>
> >> Really the only thing you can do is write a security layer yourself,
> >> either by wrapping CouchDB and converting those calls (after checking
> your
> >> own security) to be done by an admin user, or provide a separate API
> etc.
> >>
> >> Stefan
> >>> On 23 Sep 2017, at 13:40, max <maxima078@gmail.com> wrote:
> >>>
> >>> Thanks,
> >>>
> >>> Any workaround from configuration  ? I would like to avoid making mor=
e
> >>> couchdb admin...
> >>>
> >>> Le 23 sept. 2017 1:08 PM, "Stefan du Fresne" <stefan@medicmobile.org>
> a
> >>> =C3=A9crit :
> >>>
> >>>> This is currently how it works yeah.
> >>>>
> >>>> I believe the current recommendation for user management is to
> >> effectively
> >>>> ignore the permissions matrix in the _users database and instead wra=
p
> >>>> CouchDB in your own permissions management.
> >>>>
> >>>> Stefan
> >>>>> On 22 Sep 2017, at 17:36, max <maxima078@gmail.com> wrote:
> >>>>>
> >>>>> Hi,
> >>>>>
> >>>>> I'm trying CouchDB 2.1 and facing an (strange?) issue. I have given
> >>>>> admin access through "Permissions" to "user1" and every user with t=
he
> >>>>> role "manager". This allowed these users to call view from _design =
in
> >>>>> _users database. But this is not enough to delete other users, to d=
o
> >>>>> that user have to be a super CouchDB Admin. Is this the expected
> >>>>> behavior? I got "Only admins may delete other user docs" whereas he
> is
> >>>>> admin.
> >>>>>
> >>>>> This is my _users database permissions:
> >>>>>
> >>>>> {"error":"unauthorized","reason":"Authentication
> >>>>> required.","admins":{"names":["user1"],"roles":["manager"]}}
> >>>>>
> >>>>>
> >>>>> Regards,
> >>>>>
> >>>>> Max.
> >>>>
> >>>>
> >>
> >>
>
> --
> Professional Support for Apache CouchDB:
> https://neighbourhood.ie/couchdb-support/
>
>

--f403045f4c001f6fa7055a0143d7--