Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <503FCE21.9000108@83864.com>
Date: Thu, 30 Aug 2012 13:33:37 -0700
From: Wendall Cada <wendallc@83864.com>
User-Agent: Mozilla/5.0 (X11; Linux i686;
 rv:14.0) Gecko/20120717 Thunderbird/14.0
MIME-Version: 1.0
To: user@couchdb.apache.org
Subject: Re: userCtx extra information
References: <503CA33A.6080305@gmail.com>
 <CAJNb-9qEAr7tk4K5EPEcuM5RVxpS0iYSbo3QV49epoYXHs6WtA@mail.gmail.com>
 <CAHZBNKb4K0oatL-i-0SVN2W=xoGF1LijqCcR4Si6_-CdVSxBbg@mail.gmail.com>
 <CAJNb-9rXVM7vkZgK0=hErJ-BSuHzGp5r9mzkMJd8ryebLJqo8Q@mail.gmail.com>
 <CAKNVnzycMA7N7w9jNgiAC6O-rj34F66J=28m1gt-0a8_AcTuew@mail.gmail.com>
 <CAJNb-9oT5s7T3cfnggN5nU6neT8rKyLe33Ay_bR==+8kCPDkig@mail.gmail.com>
 <503F06B4.8010303@gmail.com>
 <CAJNb-9rU+dfe6Ehohxtu0rfjRFRr7S3MQre731SFKo163JqGzQ@mail.gmail.com>
 <503F4934.3010007@gmail.com>
 <EBE58485-DF28-45AB-9168-856EB4ABD213@apache.org>
 <503F592D.2000208@gmail.com>
 <CAKNVnzyxgSJ22bAHwO-B9Oee8xeEyCaA31h2kWUbWoaVj4ZNgg@mail.gmail.com>
 <8B6A2452-D9B7-4F1D-80A3-40E5170171DC@sri.com> <503FB309.4050908@83864.com>
 <101B7D24-F7A8-40E5-A821-63474277FAAA@apache.org>
In-Reply-To: <101B7D24-F7A8-40E5-A821-63474277FAAA@apache.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 08/30/2012 12:08 PM, Robert Newson wrote:
> "An example of this is a comments thread moderator. They need permissions to edit portions of a doc that doesn't belong to them. Is it proposed that I just make everyone an admin?"
>
> No. You would invent a role called "moderator". You would assign this to users you wish to be moderators, and your validate_doc_update function would prevent users who don't have the "moderator" role from editing portions of docs that don't belong to them.
My example here is bad, trying to keep it simple. I understand that this 
would be done through validation. The situation is that I have non-admin 
roles where the user can create other users, assign users to specific 
roles. This is necessary for our use-case. Is there a way to do this in 
a non-admin role? Or are there ways to have different levels of 
administrators?

A better example is that you'd have a lead moderator. They have a 
non-admin account. They need to be able to add other users to the 
moderator role. This type of question comes up frequently, and this type 
of behavior combined with attributes which are typically stored in the 
userCtx and reside in the users session allow for fine grained control 
of user behavior without having to use admin accounts for anything but 
creating databases and other admin accounts.

Maybe my understanding of this is completely incorrect here. But I'm not 
seeing any way possible to replace a third party authentication system 
with CouchDB except for the most simplistic situations possible.

Wendall
> B.
>
> On 30 Aug 2012, at 19:38, Wendall Cada wrote:
>
>> An example of this is a comments thread moderator. They need permissions to edit portions of a doc that doesn't belong to them. Is it proposed that I just make everyone an admin?