You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by "Jason Davies (JIRA)" <ji...@apache.org> on 2009/09/24 00:24:15 UTC
[jira] Created: (COUCHDB-512) Per-DB Authorization and ACL
Per-DB Authorization and ACL
----------------------------
Key: COUCHDB-512
URL: https://issues.apache.org/jira/browse/COUCHDB-512
Project: CouchDB
Issue Type: New Feature
Reporter: Jason Davies
Fix For: 0.10
Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jason Davies updated COUCHDB-512:
---------------------------------
Component/s: Database Core
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Chris Anderson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chris Anderson closed COUCHDB-512.
----------------------------------
Resolution: Fixed
I just committed a similar feature (with a different implementation). Closing this as fixed.
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Assignee: Jason Davies
> Fix For: 0.11
>
> Attachments: per_db_auth.1.patch, per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jason Davies updated COUCHDB-512:
---------------------------------
Attachment: per_db_auth.patch
Initial patch adding per-db auth using an ACL rule list defined in the "_local/_acl" in the users db ("users" by default). We can look at extending this and allow a similar document to exist per database too in the future. The ACL document looks like:
{
"_id": "_local/_acl",
"rules": [
{"db": "*", "role": "*", "deny": "*"},
{"db": "*", "role": "test", "allow": "read"},
]
}
The last matching rule wins.
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Adam Kocoloski (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759093#action_12759093 ]
Adam Kocoloski commented on COUCHDB-512:
----------------------------------------
Hi Jason, I think "first matching rule wins" is more common, e.g. in firewall rulesets. Any reason why you chose to go with last match?
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759096#action_12759096 ]
Jason Davies commented on COUCHDB-512:
--------------------------------------
Hi Adam, it seems I was mistakenly under the impression firewall rules work in the "last match" fashion, I think I will update the patch, thanks :-)
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jan Lehnardt (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759080#action_12759080 ]
Jan Lehnardt commented on COUCHDB-512:
--------------------------------------
I believe replicatable ACLs are useful, but not generally. I think we can punt on this for this first iteration that helps us to get more familiar with the code required for that matter. I don't see a reason to not have per db _acls in the future (unless there are technical issues preventing that :)
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jason Davies updated COUCHDB-512:
---------------------------------
Attachment: per_db_auth.1.patch
Fix for error when ACL doc is missing.
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.1.patch, per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Assigned: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jason Davies reassigned COUCHDB-512:
------------------------------------
Assignee: Jason Davies
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Assignee: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.1.patch, per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Benoit Chesneau (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759098#action_12759098 ]
Benoit Chesneau commented on COUCHDB-512:
-----------------------------------------
@janl i'm agree, was just asking. Even if I think having auth per db in one db sound more natural : since you replicate per db not having auth replicated with it, is weird.
Per db we could have an _acl doc + _user/id docs containing users, _users and _acl could be only changed by the owner of the db.
Speaking about replication maybe the right to replicate was forgotten ? Maybe someone could read, write but not replicate and vice-versa ?
Thinking about db matching I wonder why not puting acls in different docs and having a view matching dbs ? Since matching is already handled by couchdb. It won't match * though or maybe there could be a special match for that ? At least for auths per db in one generic db. Also thinking about that what if the number of db is big ? having acl per db splitted in differents docs may help.
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Jason Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759099#action_12759099 ]
Jason Davies commented on COUCHDB-512:
--------------------------------------
Benoit, I think we will definitely add per-db ACLs in the future, it shouldn't be hard to do. As for replicating ACLs I think that should probably be off by default as it could cause complications, but it would be needed for a cluster configuration so we would need to support it at some point.
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (COUCHDB-512) Per-DB Authorization and ACL
Posted by "Benoit Chesneau (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-512?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12759035#action_12759035 ]
Benoit Chesneau commented on COUCHDB-512:
-----------------------------------------
So you set acls in a global user db ? Wouldn't it be better if acl were set in the db rather than an external db ? So acls + users are replicated ?
> Per-DB Authorization and ACL
> ----------------------------
>
> Key: COUCHDB-512
> URL: https://issues.apache.org/jira/browse/COUCHDB-512
> Project: CouchDB
> Issue Type: New Feature
> Components: Database Core
> Reporter: Jason Davies
> Fix For: 0.10
>
> Attachments: per_db_auth.patch
>
>
> Following discussions on the mailing list, this is for tracking work and comments surrounding an implementation of per-db authorization and ACL.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.