Mailing-List: contact couchdb-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: couchdb-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of bchesneau@gmail.com
 designates 209.85.198.243 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=CI0OiECLSbMDY8/aa21rMkgphFz7ZyefKQRspP9GOfheEgArnlJ6NnLE5pv6GezT+QXLAnqC+7H5Z8iWh1TBzoEVQQFXKGo0wdX5IacOOWo7LKkEUmRlaIMukEGkzmIHkirgvP/Jx42CSB8YG36tOFD9u9CQjBvsXFHKjg1HBTQ=
Message-ID: <b7cd8ed10805101139y7517252dwe5af035d3fa8dfa@mail.gmail.com>
Date: Sat, 10 May 2008 20:39:17 +0200
From: "Benoit Chesneau" <bchesneau@gmail.com>
To: couchdb-dev@incubator.apache.org
Subject: Re: CouchDB 1.0 work
In-Reply-To: <5C06AD9F-B9B9-4016-BB88-94D3D1065173@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <6A14F004-1449-4FC9-A2EE-47BC1CAF9FED@yahoo.com>
	 <1833C7F3-E82D-4BDE-B4EB-4890D6FC2665@gmx.de>
	 <3944C148-CC00-4204-B800-5C7221273C21@gmail.com>
	 <E5C787F4-00C3-467D-92A7-822954C3B88A@gmx.de>
	 <C018A390-A2E0-41CD-9A13-5F2D9CD8803E@gmail.com>
	 <5C06AD9F-B9B9-4016-BB88-94D3D1065173@gmx.de>

On Sat, May 10, 2008 at 7:36 PM, Christopher Lenz <cmlenz@gmx.de> wrote:
> On 10.05.2008, at 17:53, Damien Katz wrote:
>>
>> On May 10, 2008, at 11:35 AM, Christopher Lenz wrote:
>>>
>>> As far as I know, the proxy will keep the auth info to itself, and the
>>> request will look like a standard anonymous request to CouchDB. I *thin=
k* if
>>> we don't implement authentication, we can not implement
>>> authorization/security for document validation.
>>
>> Well, I don't know the details of authenticating proxies, but if the use=
r
>> provides credentials in the HTTP header, and the proxy server validates =
it
>> and passes it on, then CouchDB would just use the same credentials with =
the
>> assumption they are authenticated because the HTTP server validated it. =
But
>> maybe this isn't possible for reasons I don't know about.
>
> I made a test with Apache/mod_proxy with Digest auth, and it does seem to
> pass through the auth credentials (username, realm, etc) via the
> Authorization header. So this should hopefully work in general, sorry for
> the noise :P
>
> Cheers,
> --
> Christopher Lenz
>  cmlenz at gmx.de
>  http://www.cmlenz.net/
>
>

the same with nginx or squid :)

--=20
- beno=EEt