Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of ghosh.debasish@gmail.com
 designates 209.85.210.201 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:reply-to:in-reply-to:references:from:date:message-id
         :subject:to:cc:content-type;
        b=WWbnr1TlZGNScPdf1QephUc3vznteExVle5PtV78zu38VTKZTm9REHvq3gqsyOET9u
         C6UTqjTn4aZBSB0HSRJNIHcZB7QvJrn/FbQn7DRn06rQpPjaLuSOIRrVjw3fG1YeJkSs
         OXfdyUuT35dni9xWbkmCmD0mFnZXBrRdkSu28=
MIME-Version: 1.0
Reply-To: dghosh@acm.org
In-Reply-To: <e282921e0909131046s7a89a9a7ode1438790ec1a0a6@mail.gmail.com>
References: <8b1c89270909120747r4245de68v6cd543e1787c3ea8@mail.gmail.com>
	<e282921e0909122216k6d122940nc0210f8a555ebe1d@mail.gmail.com>
	<8b1c89270909130131u57209cd4v8b56748c0fa5ee34@mail.gmail.com>
	<e282921e0909131046s7a89a9a7ode1438790ec1a0a6@mail.gmail.com>
From: Debasish Ghosh <ghosh.debasish@gmail.com>
Date: Sun, 13 Sep 2009 23:29:19 +0530
Message-ID: <8b1c89270909131059t306de1b1mf2c15c790f3d070a@mail.gmail.com>
Subject: Re: CouchDB Validation function and security API ..
To: Chris Anderson <jchris@apache.org>
Cc: user@couchdb.apache.org
Content-Type: multipart/alternative; boundary=0016e68de9121ba5a004737950b7

--0016e68de9121ba5a004737950b7
Content-Type: text/plain; charset=ISO-8859-1

On Sun, Sep 13, 2009 at 11:16 PM, Chris Anderson <jchris@apache.org> wrote:

> On Sun, Sep 13, 2009 at 1:31 AM, Debasish Ghosh
> <ghosh.debasish@gmail.com> wrote:
> > I think I am doing something wrong. Would appreciate any help on this ...
> > In my local.ini, I have set up the following :
> >
> > [admins]
> > [jchris = secretpass
> >
> > [httpd]
> > authentication_handlers = {couch_httpd, default_authentication_handler}
> >
> > and I create a database using
> >
> > curl -vX PUT http://jchris:secretpass@localhost:5984/albums
> >
> > I get : {ok, true}
> >
> > How do I get the _session handler that you have mentioned ? Doing a ..
> >
> > $ curl http://jchris:mysecretpassword@localhost:5984/_session
> >
>
> this "just works" for me. I'm not sure about cookie etc... I just give
> my creds on the curl line and _session gives me back the userCtx.
>

>> creds on the curl line means as u have mentioned ..
>> $ curl http://jchris:mysecretpassword@localhost:5984/_session ?
>> hmm .. doesn't work for me :( .. It gives me something like "illegal
database name" on _session ..
>> I am using an April snapshot of 0.10. I will try switching to a more
recent snapshot ..
>> Will u mind sharing the local.ini & default.ini ?


> I'm running from couchdb trunk but I think anything in the 0.10.x
> branch should work for this.
>
> > obviously doesn't work, since I have not set anything in the session and
> it
> > gives me an error. You have mentioned in the mail "when you are
> > properly logged in". Do I have to handle user login myself through some
> > pluggable login module ? I think I am missing something here. Help!
> >
> > Thanks.
> > - Debasish
> >
> > On Sun, Sep 13, 2009 at 10:46 AM, Chris Anderson <jchris@apache.org>
> wrote:
> >
> >> On Sat, Sep 12, 2009 at 7:47 AM, Debasish Ghosh
> >> <ghosh.debasish@gmail.com> wrote:
> >> > Hi -
> >> >
> >> > The validation function validate_doc_update takes 3 parameters,
> newdoc,
> >> > olddoc and userContext. I am trying to get my head into how the
> >> > authentication and authorization stuff is related to this. The CouchDB
> >> book
> >> > has the following code snippet in 7.2.4 Authorship section ..
> >> > function(newDoc, oldDoc, userCtx) {
> >> >  if (newDoc.author) {
> >> >    enforce(newDoc.author == userCtx.author,
> >> >      "You may only update documents with author " + userCtx.author);
> >> >  }
> >> > }
> >> >
> >> > In my linux environment, when I run CouchDB validation functions with
> a
> >> > user-id and password setup in local.ini under [admins], I get the
> >> following
> >> > as the contents of the third parameter of the validation function :-
> >> >
> >> > {"db" : "test", "name" : null, "roles" : []}
> >> >
> >> > In the above snippet from the book there appears to be a field
> >> > userCtx.author. Just wondering how to get it here and why I am not
> seeing
> >> it
> >> > in my output.
> >> >
> >>
> >> heh, thanks for the catch.. It should read:
> >>
> >> enforce(newDoc.author == userCtx.name
> >>
> >> > Also any pointer on the security, authentication and authorization
> part
> >> will
> >> > be appreciated.
> >> >
> >>
> >> I'm not sure, but you should be getting more when you are properly
> >> logged in -- this is worth investigating more. What do you get for
> >> this?:
> >>
> >> $ curl http://jchris:mysecretpassword@localhost:5984/_session
> >> {"ok":true,"name":"jchris","roles":["_admin"]}
> >>
> >>
> >> > Thanks in advance ..
> >> > - Debasish
> >> >
> >>
> >>
> >>
> >> --
> >> Chris Anderson
> >> http://jchrisa.net
> >> http://couch.io
> >>
> >
>
>
>
> --
> Chris Anderson
> http://jchrisa.net
> http://couch.io
>

--0016e68de9121ba5a004737950b7--