Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of mrtrick@gmail.com designates
 209.85.214.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=u2uOZInWNc42E9hkRWo2t+yfFOuzVS5HZpQ/68YytphC9rfgF5D3RVHuP198XcYrZk
         yHou2MzUP5XbBki7Z0z6QQmpc5XUanrI77A83SfyE7kiZgsMQFeebc05v9uJ5jLJO4fQ
         MJa514sjk/PcIywDa+UIBoGoxwzazFOHHwBzU=
Message-ID: <4CEB5D42.5030307@gmail.com>
Date: Tue, 23 Nov 2010 17:20:50 +1100
From: Patrick Barnes <mrtrick@gmail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6
MIME-Version: 1.0
To: user@couchdb.apache.org
Subject: Re: Creating databases on demand
References: <1CE29F2F-7669-414C-9D02-D75B7BF2AA06@gmail.com>
In-Reply-To: <1CE29F2F-7669-414C-9D02-D75B7BF2AA06@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi Jeff,

On 23/11/2010 5:10 PM, Jeff Gorder wrote:
> I have a case where there is a main public database that serves my application and then will need to have a private database for each user. I've gotten this to work manually and automatically when logged in as a server admin.
>
> I understand that there are server admins that have full control over the installation and that they are managed by making entries into the .ini file and that there are database admins as well. In the "Definitive Guide" it's made clear that only admin users are allowed to create databases and design documents but it's not clear if those are server admins, database admins, or both.
>
> How do I create the database/design doc for a new user? It's not practical to require someone who is a server admin to log on to Futon to do it. If a user is a database admin in the main application database, does that give them permission to create a new database?

Someone having database-level admin access only has it on that database, 
even if it's the main application database. Only a server admin can 
create a new database.

Some sort of privilege escalation is necessary, I guess. Maybe have a 
server-side script that can be triggered by main-application database 
admins, that has a stored set of server admin credentials and can create 
the database for them.

> The second question is how to access the database ACL. I have found that it's stored at dbasename/_security but haven't found any documentation about an API to it. Is there one?

See here: http://wiki.apache.org/couchdb/Complete_HTTP_API_Reference

I'm guessing it's just GET or PUT in its entirety.
[ Hmm - how are race conditions resolved on _security? :-) ]


Hope that helps,
-Patrick