Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of b.candler@pobox.com
 designates 208.72.237.25 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=date:from:to
	:subject:message-id:references:mime-version:content-type
	:in-reply-to; q=dns; s=sasl; b=sEd6ToH6auw6RZFlE7pD/c6XQEH9xGb/2
	O2fzkHJTf+6b2JCIKWvC9LAlRi3DvXfH6TRq5BvryO9Ak07gCAZBYyDr6U69uDkF
	sHasuwtnzciOxTlhIldievjPLVKr1mu0mCyHqlrq+PDsJrA/HZ6dJLRvLJUFhUFx
	UtOj5gtNCE=
Date: Tue, 16 Feb 2010 09:35:59 +0000
From: Brian Candler <B.Candler@pobox.com>
To: user@couchdb.apache.org
Subject: Re: Couchdb and futon authentication on trunk (910404)
Message-ID: <20100216093559.GA5483@uk.tiscali.com>
References: <4B7A3596.7010503@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4B7A3596.7010503@gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)

On Tue, Feb 16, 2010 at 05:05:10PM +1100, Patrick Barnes wrote:
> - In admin party mode, when offered authentication details couchdb
> and futon will complain. (from memory, I think the error was
> {"error":"unauthorized","reason":"Name or password is incorrect."})

Correct:

$ curl -v http://admin:admin@127.0.0.1:5984/
* About to connect() to 127.0.0.1 port 5984 (#0)
*   Trying 127.0.0.1... connected
* Connected to 127.0.0.1 (127.0.0.1) port 5984 (#0)
* Server auth using Basic with user 'admin'
> GET / HTTP/1.1
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.18.0 (i486-pc-linux-gnu) libcurl/7.18.0 OpenSSL/0.9.8g
* zlib/1.2.3.3 libidn/1.1
> Host: 127.0.0.1:5984
> Accept: */*
> 
< HTTP/1.1 401 Unauthorized
< Server: CouchDB/0.11.0be18ea3db-git (Erlang OTP/R12B)
< Date: Tue, 16 Feb 2010 09:31:57 GMT
< Content-Type: text/plain;charset=utf-8
< Content-Length: 67
< Cache-Control: must-revalidate
< 
{"error":"unauthorized","reason":"Name or password is incorrect."}
* Connection #0 to host 127.0.0.1 left intact
* Closing connection #0

I'd have thought that a browser would then prompt the user for new
credentials. But if they click 'cancel' I'm not sure what happens (does the
browser give up at that point, but not invalidate its cached user/pass?)

> (Also, can 'sign up' be disabled / admin users allowed to create new users?)

I think you can just set readers ACL on the _users database. But then an
admin will be required to change users' passwords too.

Regards,

Brian.