Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of simon@cloudant.com designates
 209.85.212.170 as permitted sender)
Date: Thu, 21 Jun 2012 10:34:29 +0100
From: Simon Metson <simon@cloudant.com>
To: user@couchdb.apache.org
Message-ID: <705DAE12BF7041D68AD9D4B2A56C43C7@cloudant.com>
In-Reply-To: 
 <CADA=EV8_8O4QVJHg7r+8ayNou0MPj3VT39jHh-apzCgumPJoLw@mail.gmail.com>
References: 
 <CADA=EV9TtV8QNrfzBbPKgHs6eB1AbwWojHjYzaFz6qUgBW4xHQ@mail.gmail.com>
 <CAHZBNKYu9cPi5a9gitB3Y11u7328GNVizc0RUNx-j_96c0HfkQ@mail.gmail.com>
 <CADA=EV_D5B373-SuR2rBPjzs9XXqia3k7SjS-pHXcUCAP0C8QA@mail.gmail.com>
 <57FA970C-94DA-4804-A07D-B5734ACE5632@apache.org>
 <CADA=EV8_8O4QVJHg7r+8ayNou0MPj3VT39jHh-apzCgumPJoLw@mail.gmail.com>
Subject: Re: Replication and validate_doc_field
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="4fe2eaa5_7c3dbd3d_1265d"

--4fe2eaa5_7c3dbd3d_1265d
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi, 


On Thursday, 21 June 2012 at 01:57, Pulkit Singhal wrote:

> Right, so what I'm saying is that the replicator client is being run with
> the creds of a super-duper-admin who inherently has _admin privileges.
> 
> When the same code is run against a DB without any reader roles, everything
> works out. But when it is run against a DB with a reader role, it fails.
> 
> I'm hoping that someone will clarify the security constraints around how
> replication behaves with db level security in 1.2.0
> 
> 

I think the problem is that the request to the origin DB needs to be authenticated, because you have the readers set up. You need to authorise the read request, and the fact that the replication was created on the destination as _admin means nothing (that would be a massive security hole - if I could read from anyones database just because I was an admin of my own). 

Sounds like you need to include a username/password in the source URL that has the reader role:

curl -X POST 'http://localhost:5984/_replicate' -d '{"target":"my_database", "source":"http://username:password@remotehost:5984/some_other_database"}'

HTH
Simon


--4fe2eaa5_7c3dbd3d_1265d--