Trouble setting up proxy auth

[Tom Chiverton <tc...@extravision.com>]

I'm trying to get CouchDB to use an Apache front end for authentication.

To do this I've made sure authentication_handlers includes the proxy 
handler:

authentication_handlers = {couch_httpd_oauth, 
oauth_authentication_handler}, {couch_httpd_auth, 
cookie_authentication_handler}, {couch_httpd_auth, 
proxy_authentication_handler}, {couch_httpd_auth, 
default_authentication_handler}

But I can't do normal admin actions by supplying the expected headers:
# curl --header "X-Auth-CouchDB-UserName: admin" --header 
"X-Auth-CouchDB-Roles: admin,user" -X PUT http://localhost:5984/new/
{"error":"unauthorized","reason":"You are not a server admin."}

I'm basing this on
http://docs.couchdb.org/en/1.6.1/api/server/authn.html#proxy-authentication

Is there some step I missed ?

-- 
*Tom Chiverton*
Lead Developer
e: 	tc@extravision.com <ma...@extravision.com>
p: 	0161 817 2922
t: 	@extravision <http://www.twitter.com/extravision>
w: 	www.extravision.com <http://www.extravision.com/>

Extravision - email worth seeing <http://www.extravision.com/>
Registered in the UK at: 107 Timber Wharf, 33 Worsley Street, 
Manchester, M15 4LD.
Company Reg No: 0‌‌5017214 VAT: GB 8‌‌24 5386 19

This e-mail is intended solely for the person to whom it is addressed 
and may contain confidential or privileged information.
Any views or opinions presented in this e-mail are solely of the author 
and do not necessarily represent those of Extravision Ltd.

Re: Trouble setting up proxy auth

[Tom Chiverton <tc...@extravision.com>]

On 01/10/15 11:51, Alexander Shorin wrote:
> On Thu, Oct 1, 2015 at 1:49 PM, Mike Marino <mm...@gmail.com> wrote:
>
>> I'm not sure if this is the only problem (i.e. are you also forcing the
>> shared key to be used?), but roles should contain:
>>
>> _admin
>>
>> if you want an admin user.
>>
>
> ​This is correct.​
>
>

Argh ! Thanks for pointing out the obvious ;-)

Tom

Re: Trouble setting up proxy auth

[Alexander Shorin <kx...@gmail.com>]

On Thu, Oct 1, 2015 at 1:49 PM, Mike Marino <mm...@gmail.com> wrote:

> I'm not sure if this is the only problem (i.e. are you also forcing the
> shared key to be used?), but roles should contain:
>
> _admin
>
> if you want an admin user.
>


​This is correct.​

--
,,,^..^,,,

Re: Trouble setting up proxy auth

[Mike Marino <mm...@gmail.com>]

I'm not sure if this is the only problem (i.e. are you also forcing the
shared key to be used?), but roles should contain:

_admin

if you want an admin user.

On Thu, Oct 1, 2015 at 12:42 PM, Tom Chiverton <tc...@extravision.com> wrote:

> I'm trying to get CouchDB to use an Apache front end for authentication.
>
> To do this I've made sure authentication_handlers includes the proxy
> handler:
>
> authentication_handlers = {couch_httpd_oauth,
> oauth_authentication_handler}, {couch_httpd_auth,
> cookie_authentication_handler}, {couch_httpd_auth,
> proxy_authentication_handler}, {couch_httpd_auth,
> default_authentication_handler}
>
> But I can't do normal admin actions by supplying the expected headers:
> # curl --header "X-Auth-CouchDB-UserName: admin" --header
> "X-Auth-CouchDB-Roles: admin,user" -X PUT http://localhost:5984/new/
> {"error":"unauthorized","reason":"You are not a server admin."}
>
> I'm basing this on
> http://docs.couchdb.org/en/1.6.1/api/server/authn.html#proxy-authentication
>
> Is there some step I missed ?
>
> --
> *Tom Chiverton*
> Lead Developer e:  <tc...@extravision.com>tc@extravision.com p:  0161 817
> 2922 t:  @extravision <http://www.twitter.com/extravision> w:
> <http://www.extravision.com/>www.extravision.com [image: Extravision -
> email worth seeing] <http://www.extravision.com/> Registered in the UK
> at: 107 Timber Wharf, 33 Worsley Street, Manchester, M15 4LD.
> Company Reg No: 0‌‌5017214 VAT: GB 8‌‌24 5386 19
>
> This e-mail is intended solely for the person to whom it is addressed and
> may contain confidential or privileged information.
> Any views or opinions presented in this e-mail are solely of the author
> and do not necessarily represent those of Extravision Ltd.
>