Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of samuelgoto@gmail.com designates
 209.85.216.52 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=a5dJmv4ibxJltUvVEMuoCW4CCKpp0nINC+QqUH5hEZEZ2XRIsruHqySssc0qQMi2Ew
         DwfU7V7oq6j9JxSO+ZJZchmKwxLAvExY1qaTC+cpiFSQsfDOn14c2FzH5UaOUgkkG6QN
         +ruY+Xk6oMDNWTjSHUvTlLDueAFho27GCKmbk=
MIME-Version: 1.0
In-Reply-To: <305377FE-ACE8-4D67-BB02-8B78BB2B45F8@apache.org>
References: <AANLkTin1UWCX+-rW4pMT0ikDtwYcq+TmRfd40L967vxf@mail.gmail.com>
	<305377FE-ACE8-4D67-BB02-8B78BB2B45F8@apache.org>
Date: Fri, 20 Aug 2010 21:31:56 -0700
Message-ID: <AANLkTi=qWzmqc=A3UGH3yVB0f+OqbegTGw+f=nCYF+11@mail.gmail.com>
Subject: Re: What are the contents of userCtx in validators ?
From: sgoto <samuelgoto@gmail.com>
To: user@couchdb.apache.org
Content-Type: multipart/alternative; boundary=000feaeadea23c1851048e4de507

--000feaeadea23c1851048e4de507
Content-Type: text/plain; charset=ISO-8859-1

On Wed, Aug 4, 2010 at 7:01 AM, J Chris Anderson <jchris@apache.org> wrote:

>
> On Aug 3, 2010, at 8:30 PM, sgoto wrote:
>
> > Hey everyone,
> >
> >   According to this page:
> >
> > http://books.couchdb.org/relax/design-documents/validation-functions
> >
> >   An administrator could write validation function to ensure the data
> that
> > gets written to couchdb is validated. I'm interested in adding some
> PGP-like
> > signing of documents for authentication. I'm also interested in md5ing
> the
> > contents of the message to ensure integrity, but i'll leave that for
> later.
> >
> >  This leads me to the following question:
> >
> >  What are the contents of userCtx in the validator's signature ?
> >
> > function(newDoc, oldDoc, userCtx) {
> >  throw({forbidden : 'no way'});
> > }
> >
>
> the best way to learn this is to do
>
> log(userCtx) inside your function.
>
> the contents of the userCtx are minimal, just name and roles. The idea
> behind this is to make a narrow lowest common denominator so LDAP, kerberos,
> etc can all work with existing apps.
>
> >
> > would it be the contents of the authentication database ?
> >
> > http://wiki.apache.org/couchdb/Security_Features_Overview
> > http://wiki.apache.org/couchdb/Authentication_and_Authorization
> >
> > {
> >  "_id"          : "org.couchdb.user:joe",
> >  "type"         : "user",
> >  "name"         : "joe",
> >  "roles"        : ["erlanger"],
> >  "password_sha" : "fe95df1ca59a9b567bdca5cbaf8412abd6e06121",
> >  "salt"         : "4e170ffeb6f34daecfd814dfb4001a73"
> > }
> >
> >
> > any existing work/library/method (eg CA vs web of trust, storing
> encrypted
> > documents, signing, integrity, etc) that I should be aware of ?
> >
>
> Hard part is getting something to sign. I have started this project here:
>
> http://github.com/jchris/canonical-json
>
>
this is a very interesting library @jchris. i'm not sure a canonical
representation of a json is absolutely necessary, if you are signing binary
base64 data for example.

i am interesting in having authentication and authorization to be done with
PGP/GPG certificates (to make sure replication works with untrusted nodes).
how far have you gotten with parsing/extracting/verifying  PGP certificates
(you seem to be using the same library i am to parse/extract/verify PGP
certificates
http://github.com/jchris/canonical-json/tree/master/www.hanewin.net/) ?


> (plz ignore the name)
>
> Chris
>
> > --
> > f u cn rd ths u cn b a gd prgmr !
>
>


-- 
f u cn rd ths u cn b a gd prgmr !

--000feaeadea23c1851048e4de507--