Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of jchris@gmail.com designates
 209.85.212.171 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=FlyYkaLaNfjjVwKfZLhq3c9qLKWlHc2e6xI8NUI8Q+w7YLc/SxgSCPEtDbCxjL2op+
         2+v0i8XFOijIbMupF/Sr5yIMvAptiGAMk6Jyz0gV9NGewlsFsrU8M6tofYvs32/nQoi9
         3iCkHZ/WuYUw5RDZNL/HmvLS66CP2LMz/YymI=
MIME-Version: 1.0
Sender: jchris@gmail.com
In-Reply-To: <8b1c89270909131059t306de1b1mf2c15c790f3d070a@mail.gmail.com>
References: <8b1c89270909120747r4245de68v6cd543e1787c3ea8@mail.gmail.com>
	 <e282921e0909122216k6d122940nc0210f8a555ebe1d@mail.gmail.com>
	 <8b1c89270909130131u57209cd4v8b56748c0fa5ee34@mail.gmail.com>
	 <e282921e0909131046s7a89a9a7ode1438790ec1a0a6@mail.gmail.com>
	 <8b1c89270909131059t306de1b1mf2c15c790f3d070a@mail.gmail.com>
Date: Sun, 13 Sep 2009 22:25:40 -0700
Message-ID: <e282921e0909132225x1f5911c0h562b5c1ec46c684@mail.gmail.com>
Subject: Re: CouchDB Validation function and security API ..
From: Chris Anderson <jchris@apache.org>
To: user@couchdb.apache.org, dghosh@acm.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 13, 2009 at 10:59 AM, Debasish Ghosh
<ghosh.debasish@gmail.com> wrote:
> On Sun, Sep 13, 2009 at 11:16 PM, Chris Anderson <jchris@apache.org> wrot=
e:
>
>> On Sun, Sep 13, 2009 at 1:31 AM, Debasish Ghosh
>> <ghosh.debasish@gmail.com> wrote:
>> > I think I am doing something wrong. Would appreciate any help on this =
...
>> > In my local.ini, I have set up the following :
>> >
>> > [admins]
>> > [jchris =3D secretpass
>> >
>> > [httpd]
>> > authentication_handlers =3D {couch_httpd, default_authentication_handl=
er}
>> >
>> > and I create a database using
>> >
>> > curl -vX PUT http://jchris:secretpass@localhost:5984/albums
>> >
>> > I get : {ok, true}
>> >
>> > How do I get the _session handler that you have mentioned ? Doing a ..
>> >
>> > $ curl http://jchris:mysecretpassword@localhost:5984/_session
>> >
>>
>> this "just works" for me. I'm not sure about cookie etc... I just give
>> my creds on the curl line and _session gives me back the userCtx.
>>
>
>>> creds on the curl line means as u have mentioned ..
>>> $ curl http://jchris:mysecretpassword@localhost:5984/_session ?
>>> hmm .. doesn't work for me :( .. It gives me something like "illegal
> database name" on _session ..
>>> I am using an April snapshot of 0.10. I will try switching to a more
> recent snapshot ..
>>> Will u mind sharing the local.ini & default.ini ?
>

I'm currently on trunk using make dev && utils/run, my password line is:

jchris =3D -hashed-7d882376727dadb528a9e4b160809f46674157fb,32ba977823a5e7a=
4d978b2139149706a

>
>> I'm running from couchdb trunk but I think anything in the 0.10.x
>> branch should work for this.
>>
>> > obviously doesn't work, since I have not set anything in the session a=
nd
>> it
>> > gives me an error. You have mentioned in the mail "when you are
>> > properly logged in". Do I have to handle user login myself through som=
e
>> > pluggable login module ? I think I am missing something here. Help!
>> >
>> > Thanks.
>> > - Debasish
>> >
>> > On Sun, Sep 13, 2009 at 10:46 AM, Chris Anderson <jchris@apache.org>
>> wrote:
>> >
>> >> On Sat, Sep 12, 2009 at 7:47 AM, Debasish Ghosh
>> >> <ghosh.debasish@gmail.com> wrote:
>> >> > Hi -
>> >> >
>> >> > The validation function validate_doc_update takes 3 parameters,
>> newdoc,
>> >> > olddoc and userContext. I am trying to get my head into how the
>> >> > authentication and authorization stuff is related to this. The Couc=
hDB
>> >> book
>> >> > has the following code snippet in 7.2.4 Authorship section ..
>> >> > function(newDoc, oldDoc, userCtx) {
>> >> > =A0if (newDoc.author) {
>> >> > =A0 =A0enforce(newDoc.author =3D=3D userCtx.author,
>> >> > =A0 =A0 =A0"You may only update documents with author " + userCtx.a=
uthor);
>> >> > =A0}
>> >> > }
>> >> >
>> >> > In my linux environment, when I run CouchDB validation functions wi=
th
>> a
>> >> > user-id and password setup in local.ini under [admins], I get the
>> >> following
>> >> > as the contents of the third parameter of the validation function :=
-
>> >> >
>> >> > {"db" : "test", "name" : null, "roles" : []}
>> >> >
>> >> > In the above snippet from the book there appears to be a field
>> >> > userCtx.author. Just wondering how to get it here and why I am not
>> seeing
>> >> it
>> >> > in my output.
>> >> >
>> >>
>> >> heh, thanks for the catch.. It should read:
>> >>
>> >> enforce(newDoc.author =3D=3D userCtx.name
>> >>
>> >> > Also any pointer on the security, authentication and authorization
>> part
>> >> will
>> >> > be appreciated.
>> >> >
>> >>
>> >> I'm not sure, but you should be getting more when you are properly
>> >> logged in -- this is worth investigating more. What do you get for
>> >> this?:
>> >>
>> >> $ curl http://jchris:mysecretpassword@localhost:5984/_session
>> >> {"ok":true,"name":"jchris","roles":["_admin"]}
>> >>
>> >>
>> >> > Thanks in advance ..
>> >> > - Debasish
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> Chris Anderson
>> >> http://jchrisa.net
>> >> http://couch.io
>> >>
>> >
>>
>>
>>
>> --
>> Chris Anderson
>> http://jchrisa.net
>> http://couch.io
>>
>


--=20
Chris Anderson
http://jchrisa.net
http://couch.io