Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of bchesneau@gmail.com
 designates 209.85.215.52 as permitted sender)
Received-SPF: pass (google.com: domain of bchesneau@gmail.com designates
 10.152.102.237 as permitted sender) client-ip=10.152.102.237;
MIME-Version: 1.0
In-Reply-To: <DF714ABC-F4EB-40D4-B2AF-6CBECE863B84@gmail.com>
References: <DF714ABC-F4EB-40D4-B2AF-6CBECE863B84@gmail.com>
Date: Fri, 24 Feb 2012 08:40:20 +0100
Message-ID: 
 <CAJNb-9qJp4pazT00Ntbu8Z=bSfaxHMQEKq9FN7_gJ7gVFKCeJw@mail.gmail.com>
Subject: Re: proxy authentication handler
From: Benoit Chesneau <bchesneau@gmail.com>
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 13, 2012 at 10:02 PM, Michael Ferjancic
<michael.ferjancic@gmail.com> wrote:
> Hi guys,
>
> I have to admit that i am fairly new to this topic, especially new to erl=
ang. Currently i am trying to play around with the various authentication h=
andlers - goal is to have a working "delegated authentication" on facebook,=
 twitter and such.
>
> 1) as far as i understood the oAuth implementation of couchdb is just the=
 opposite i need - you can use that to create tokens for couch-users, but n=
ot to accept twitter accessTokens/secrets and map that to a couch user
> 2) i found exactly what i need in datacouch - authentication against twit=
ter with nodejs, and after that getting the plaintext password from a priva=
te couch and use it with _session-API to create a couch cookie.
> 3) i modified the sample a little bit and used everyauth to handle the de=
legated authentication. I map the userinfos i get from facebook etc. agains=
t user profiles in a private db, which also contains the user passwords (un=
fortunately still in plaintext). Works perfectly, but.....
>
> Now i am trying to avoid storing the plaintext passwords. I heard about t=
o use proxy_authentification_handler, but it seems i am too stupid to use i=
t. I made the (as far as i understood) correct entries in couch_httpd_auth
>
> couch_httpd_auth =A0 =A0 =A0 =A0auth_cache_size
> 50
> x
> authentication_db
> _users
> x
> authentication_redirect
> /_utils/session.html
> x
> require_valid_user
> false
> x
> secret
> xxxxxxxxxxxx
> x
> timeout
> 43200
> x
> x_auth_roles
> roles
> x
> x_auth_token
> token
> x
> x_auth_username
> uname
>
>
> and also in httpd
> httpd =A0 allow_jsonp
> true
> x
> authentication_handlers
> {couch_httpd_auth, proxy_authentification_handler},{couch_httpd_auth, coo=
kie_authentication_handler}, {couch_httpd_auth, default_authentication_hand=
ler}
> x
> bind_address
> 127.0.0.1
> x
> default_handler
> {couch_httpd_db, handle_request}
> x
> port
> 5984
> x
> secure_rewrites
> false
> x
> vhost_global_handlers
> _utils, _uuids, _session, _oauth, _users
>
> When i now do a GET on http://localhost:5984/_utils/config.html?uname=3Du=
ser1&roles=3Duser that seems to doesn't lead to anything...
>
> Anybody ever got that thing running? Am i missing something? Or is there =
any chance to implement a custom authentication handler without coding erla=
ng?
>
> Thanks for your help
> Michael
>


The proxy_oauth_header is simply a way to pass the credentials of a
user from your app to couchdb. Tou do that by passing specific headers
to CouchDB and the handler create the userCtx.
 Headers  name can be defined in local.ini. By thefault they are :

 * X-Auth-CouchDB-UserName : contain the username, (x_auth_username in
 couch_httpd_auth section)
* X-Auth-CouchDB-Roles : contain the user roles, list of roles separated by=
 a
comma (x_auth_roles in couch_httpd_auth section)
* X-Auth-CouchDB-Token : token to authenticate the authorization
(x_auth_token in couch_httpd_auth section). This token is an hmac-sha1
created from secret key  and username. The secret key should be the
same in the client and couchdb node. s  ecret key is the secret key in
couch_httpd_auth section of ini. This token is optional if value of
the proxy_use_secret key in couch_httpd_auth section of ini isn't
true.

Hope it helps.

- beno=EEt