Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Sender: J Chris Anderson <jchris@couch.io>
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
Subject: Re: What are the contents of userCtx in validators ?
From: J Chris Anderson <jchris@apache.org>
In-Reply-To: <AANLkTin1UWCX+-rW4pMT0ikDtwYcq+TmRfd40L967vxf@mail.gmail.com>
Date: Wed, 4 Aug 2010 07:01:10 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <305377FE-ACE8-4D67-BB02-8B78BB2B45F8@apache.org>
References: <AANLkTin1UWCX+-rW4pMT0ikDtwYcq+TmRfd40L967vxf@mail.gmail.com>
To: user@couchdb.apache.org


On Aug 3, 2010, at 8:30 PM, sgoto wrote:

> Hey everyone,
>=20
>   According to this page:
>=20
> http://books.couchdb.org/relax/design-documents/validation-functions
>=20
>   An administrator could write validation function to ensure the data =
that
> gets written to couchdb is validated. I'm interested in adding some =
PGP-like
> signing of documents for authentication. I'm also interested in md5ing =
the
> contents of the message to ensure integrity, but i'll leave that for =
later.
>=20
>  This leads me to the following question:
>=20
>  What are the contents of userCtx in the validator's signature ?
>=20
> function(newDoc, oldDoc, userCtx) {
>  throw({forbidden : 'no way'});
> }
>=20

the best way to learn this is to do

log(userCtx) inside your function.

the contents of the userCtx are minimal, just name and roles. The idea =
behind this is to make a narrow lowest common denominator so LDAP, =
kerberos, etc can all work with existing apps.

>=20
> would it be the contents of the authentication database ?
>=20
> http://wiki.apache.org/couchdb/Security_Features_Overview
> http://wiki.apache.org/couchdb/Authentication_and_Authorization
>=20
> {
>  "_id"          : "org.couchdb.user:joe",
>  "type"         : "user",
>  "name"         : "joe",
>  "roles"        : ["erlanger"],
>  "password_sha" : "fe95df1ca59a9b567bdca5cbaf8412abd6e06121",
>  "salt"         : "4e170ffeb6f34daecfd814dfb4001a73"
> }
>=20
>=20
> any existing work/library/method (eg CA vs web of trust, storing =
encrypted
> documents, signing, integrity, etc) that I should be aware of ?
>=20

Hard part is getting something to sign. I have started this project =
here:

http://github.com/jchris/canonical-json

(plz ignore the name)

Chris

> --=20
> f u cn rd ths u cn b a gd prgmr !