You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by Christopher Lenz <cm...@gmx.de> on 2008/05/10 16:09:36 UTC
Re: CouchDB 1.0 work
On 28.04.2008, at 18:27, Damien Katz wrote:
> Here are my thoughts on what we need for before we can get to
> CouchDB 1.0. Feedback please.
>
> Must have:
[...]
> Security/Document validation: We need a way to control who can
> update what documents and to validate the updates are correct. This
> is absolutely necessary for offline replication, where replicated
> updates to the database do not come through the application layer.
[...]
> Don't Need:
>
> Authentication. We can go to 1.0 without authentication, relying
> instead on local proxies to provide authentication.
So how would we provide authorization without authentication? There
needs to be some way to identify who's making a request, and if we
plan to rely on proxies for that, those proxies need to provide a way
to pass on the authentication results (e.g. REMOTE_USER). I suspect
they don't do that, but I may be wrong.
Cheers,
--
Christopher Lenz
cmlenz at gmx.de
http://www.cmlenz.net/
Re: CouchDB 1.0 work
Posted by Benoit Chesneau <bc...@gmail.com>.
On Sat, May 10, 2008 at 7:36 PM, Christopher Lenz <cm...@gmx.de> wrote:
> On 10.05.2008, at 17:53, Damien Katz wrote:
>>
>> On May 10, 2008, at 11:35 AM, Christopher Lenz wrote:
>>>
>>> As far as I know, the proxy will keep the auth info to itself, and the
>>> request will look like a standard anonymous request to CouchDB. I *think* if
>>> we don't implement authentication, we can not implement
>>> authorization/security for document validation.
>>
>> Well, I don't know the details of authenticating proxies, but if the user
>> provides credentials in the HTTP header, and the proxy server validates it
>> and passes it on, then CouchDB would just use the same credentials with the
>> assumption they are authenticated because the HTTP server validated it. But
>> maybe this isn't possible for reasons I don't know about.
>
> I made a test with Apache/mod_proxy with Digest auth, and it does seem to
> pass through the auth credentials (username, realm, etc) via the
> Authorization header. So this should hopefully work in general, sorry for
> the noise :P
>
> Cheers,
> --
> Christopher Lenz
> cmlenz at gmx.de
> http://www.cmlenz.net/
>
>
the same with nginx or squid :)
--
- benoît
Re: CouchDB 1.0 work
Posted by Christopher Lenz <cm...@gmx.de>.
On 10.05.2008, at 17:53, Damien Katz wrote:
> On May 10, 2008, at 11:35 AM, Christopher Lenz wrote:
>> As far as I know, the proxy will keep the auth info to itself, and
>> the request will look like a standard anonymous request to CouchDB.
>> I *think* if we don't implement authentication, we can not
>> implement authorization/security for document validation.
>
> Well, I don't know the details of authenticating proxies, but if the
> user provides credentials in the HTTP header, and the proxy server
> validates it and passes it on, then CouchDB would just use the same
> credentials with the assumption they are authenticated because the
> HTTP server validated it. But maybe this isn't possible for reasons
> I don't know about.
I made a test with Apache/mod_proxy with Digest auth, and it does seem
to pass through the auth credentials (username, realm, etc) via the
Authorization header. So this should hopefully work in general, sorry
for the noise :P
Cheers,
--
Christopher Lenz
cmlenz at gmx.de
http://www.cmlenz.net/
Re: CouchDB 1.0 work
Posted by Damien Katz <da...@gmail.com>.
On May 10, 2008, at 11:35 AM, Christopher Lenz wrote:
> On 10.05.2008, at 16:47, Damien Katz wrote:
>> On May 10, 2008, at 10:09 AM, Christopher Lenz wrote:
>>
>>> On 28.04.2008, at 18:27, Damien Katz wrote:
>>>> Here are my thoughts on what we need for before we can get to
>>>> CouchDB 1.0. Feedback please.
>>>>
>>>> Must have:
>>> [...]
>>>> Security/Document validation: We need a way to control who can
>>>> update what documents and to validate the updates are correct.
>>>> This is absolutely necessary for offline replication, where
>>>> replicated updates to the database do not come through the
>>>> application layer.
>>> [...]
>>>> Don't Need:
>>>>
>>>> Authentication. We can go to 1.0 without authentication, relying
>>>> instead on local proxies to provide authentication.
>>>
>>> So how would we provide authorization without authentication?
>>> There needs to be some way to identify who's making a request, and
>>> if we plan to rely on proxies for that, those proxies need to
>>> provide a way to pass on the authentication results (e.g.
>>> REMOTE_USER). I suspect they don't do that, but I may be wrong.
>>
>> I'm thinking the proxy server will authenticate the users
>> credentials in the request HTTP header, then let the request pass
>> normally to the CouchDB server. If it can't authenticate, then it
>> rejects the request.
>
> Yeah, but how will CouchDB be able to use the authentication results
> to provide the "Security/Document validation" feature?
>
>
> As far as I know, the proxy will keep the auth info to itself, and
> the request will look like a standard anonymous request to CouchDB.
> I *think* if we don't implement authentication, we can not implement
> authorization/security for document validation.
Well, I don't know the details of authenticating proxies, but if the
user provides credentials in the HTTP header, and the proxy server
validates it and passes it on, then CouchDB would just use the same
credentials with the assumption they are authenticated because the
HTTP server validated it. But maybe this isn't possible for reasons I
don't know about.
-Damien
Re: CouchDB 1.0 work
Posted by Christopher Lenz <cm...@gmx.de>.
On 10.05.2008, at 16:47, Damien Katz wrote:
> On May 10, 2008, at 10:09 AM, Christopher Lenz wrote:
>
>> On 28.04.2008, at 18:27, Damien Katz wrote:
>>> Here are my thoughts on what we need for before we can get to
>>> CouchDB 1.0. Feedback please.
>>>
>>> Must have:
>> [...]
>>> Security/Document validation: We need a way to control who can
>>> update what documents and to validate the updates are correct.
>>> This is absolutely necessary for offline replication, where
>>> replicated updates to the database do not come through the
>>> application layer.
>> [...]
>>> Don't Need:
>>>
>>> Authentication. We can go to 1.0 without authentication, relying
>>> instead on local proxies to provide authentication.
>>
>> So how would we provide authorization without authentication? There
>> needs to be some way to identify who's making a request, and if we
>> plan to rely on proxies for that, those proxies need to provide a
>> way to pass on the authentication results (e.g. REMOTE_USER). I
>> suspect they don't do that, but I may be wrong.
>
> I'm thinking the proxy server will authenticate the users
> credentials in the request HTTP header, then let the request pass
> normally to the CouchDB server. If it can't authenticate, then it
> rejects the request.
Yeah, but how will CouchDB be able to use the authentication results
to provide the "Security/Document validation" feature?
As far as I know, the proxy will keep the auth info to itself, and the
request will look like a standard anonymous request to CouchDB. I
*think* if we don't implement authentication, we can not implement
authorization/security for document validation.
Cheers,
--
Christopher Lenz
cmlenz at gmx.de
http://www.cmlenz.net/
Re: CouchDB 1.0 work
Posted by Damien Katz <da...@gmail.com>.
On May 10, 2008, at 10:09 AM, Christopher Lenz wrote:
> On 28.04.2008, at 18:27, Damien Katz wrote:
>> Here are my thoughts on what we need for before we can get to
>> CouchDB 1.0. Feedback please.
>>
>> Must have:
> [...]
>> Security/Document validation: We need a way to control who can
>> update what documents and to validate the updates are correct. This
>> is absolutely necessary for offline replication, where replicated
>> updates to the database do not come through the application layer.
> [...]
>> Don't Need:
>>
>> Authentication. We can go to 1.0 without authentication, relying
>> instead on local proxies to provide authentication.
>
> So how would we provide authorization without authentication? There
> needs to be some way to identify who's making a request, and if we
> plan to rely on proxies for that, those proxies need to provide a
> way to pass on the authentication results (e.g. REMOTE_USER). I
> suspect they don't do that, but I may be wrong.
I'm thinking the proxy server will authenticate the users credentials
in the request HTTP header, then let the request pass normally to the
CouchDB server. If it can't authenticate, then it rejects the request.
-Damien