You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by "Napsty (via GitHub)" <gi...@apache.org> on 2025/02/18 19:49:03 UTC
[I] Unable to create user in _users db (received undefined) [couchdb]
Napsty opened a new issue, #5436:
URL: https://github.com/apache/couchdb/issues/5436
[NOTE]: # ( ^^ Provide a general summary of the issue in the title above. ^^ )
## Description
Tried to create a simple user in _users database, according to the documentation (https://docs.couchdb.org/en/stable/intro/security.html#creating-a-new-user)
## Steps to Reproduce
Run `curl` command, as seen in the documentation:
```
$ curl -X PUT http://admin:secretpw@localhost:5984/_users/org.couchdb.user:jan -H "Accept: application/json" -H "Content-Type: application/json" -d '{"name": "jan", "password": "apple", "roles": [], "type": "user"}'
```
The following error appears:
```
{"error":"unknown_error","reason":"{[{<<\"_id\">>,<<\"org.couchdb.user:jan\">>},\n {<<\"type\">>,<<\"user\">>},\n {<<\"updated_by\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"d_updated\">>,\n {[{<<\"errorMessage\">>,\n <<\"dateValidator expected a string but received undefined.\">>}]}},\n {<<\"firstname\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"surname\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"name\">>,<<\"jan\">>},\n {<<\"roles\">>,[]},\n {<<\"street\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"zip\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"city\">>,\n {[{<<\"errorMessage\">>,\n <<\"St
ringValidator expected a string but received undefined.\">>}]}},\n {<<\"country\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"gender\">>,\n {[{<<\"errorMessage\">>,\n <<\"StringValidator expected a string but received undefined.\">>}]}},\n {<<\"birthday\">>,\n {[{<<\"errorMessage\">>,\n <<\"dateValidator expected a string but received undefined.\">>}]}},\n {<<\"salt\">>,<<\"19f88637fb2f3a3d32520e441567fe94\">>},\n {<<\"password_scheme\">>,<<\"pbkdf2\">>},\n {<<\"derived_key\">>,<<\"ade9a4560ef513cf442d1397f2962bed53dfaba9\">>},\n {<<\"iterations\">>,10},\n {<<\"format\">>,<<\"short\">>}]}"}
```
Also tried with `-d '{"_id": "org.couchdb.user:jan", "name": "jan", "password": "apple", "roles": [], "type": "user"}'`, same error.
## Expected Behaviour
The user should be created.
## Your Environment
```
{"couchdb":"Welcome","version":"3.3.2","git_sha":"11a234070","uuid":"748bdf2cfcee138d002d7e7fb251f1c1","features":["access-ready","partitioned","pluggable-storage-engines","reshard","scheduler"],"vendor":{"name":"The Apache Software Foundation"}}
```
* CouchDB version used: 3.3.2
* Browser name and version: irrelevant
* Operating system and version: Debian 11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "Napsty (via GitHub)" <gi...@apache.org>.
Napsty closed issue #5436: Unable to create user in _users db (received undefined)
URL: https://github.com/apache/couchdb/issues/5436
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "nickva (via GitHub)" <gi...@apache.org>.
nickva commented on issue #5436:
URL: https://github.com/apache/couchdb/issues/5436#issuecomment-2669875778
@Napsty Wonder if they added an extra `validate_doc_update` function (a VDU) which is checking that each document should have city/country fields and fails otherwise? On it's own just adding extra fields should be ok. For instance, here I add city and country fields just fine:
```
% curl -X PUT http://adm:pass@localhost:15984/_users/org.couchdb.user:jan
-H "Accept: application/json"
-H "Content-Type: application/json"
-d '{"name": "jan", "password": "apple", "roles": [], "type": "user", "city":"London", "country":"UK"}'
{"ok":true,"id":"org.couchdb.user:jan","rev":"1-4fd560a1713729f535b2a822ad95f3c4"}
```
```
% curl http://adm:pass@localhost:15984/_users/org.couchdb.user:jan
{
"_id":"org.couchdb.user:jan",
"_rev":"1-4fd560a1713729f535b2a822ad95f3c4",
"password_scheme":"pbkdf2",
"pbkdf2_prf":"sha256",
"salt":"d4e412307a2cef7aaebe07e8789a3429",
"iterations":600000,
"derived_key":
"28b2f379fb4d7609099ae8292cde6363e4c530ef765e96737d2e68001411b5af",
"name":"jan",
"roles":[],
"type":"user",
"city":"London",
"country":"UK"
}
```
But in your case it looks like something is performing extra validation somewhere.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "Napsty (via GitHub)" <gi...@apache.org>.
Napsty commented on issue #5436:
URL: https://github.com/apache/couchdb/issues/5436#issuecomment-2670620277
> On it's own just adding extra fields should be ok
Good to know, thanks. I just verified this and the original fields/keys are still in the _users table.
A lot of additional keys were created in that table.
> Wonder if they added an extra validate_doc_update function
I looked this up, and you're spot on:
```
$ curl -s http://localhost:5984/_users/_design/user -u adm:secret | jq
{
"_id": "_design/user",
"_rev": "15-588b1716de43ee8b9b12fa95c11f368d",
"validate_doc_update": "function(newDoc, oldDoc, userCtx, secObj) {\n if (newDoc._deleted === true) {\n
[...]
```
This definitely seems to be the reason why I got the error trying to add a user. The CouchDB user seems to add users to _users with the relevant/required fields.
Could this function also be the cause (interfere) why a "per user db" is not created anymore?
What is your recommendation in general? Is it a good or bad idea to use _users as application user database?
Appreciate your hints and insights, thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "Napsty (via GitHub)" <gi...@apache.org>.
Napsty commented on issue #5436:
URL: https://github.com/apache/couchdb/issues/5436#issuecomment-2667472858
Hi @nickva , thanks for your quick response.
Having had a look at the `_users` database in "table" view (in Fauxton), it seems that the end user working with this CouchDB has altered the`_users` database and added additional fields, such as `city` and `country` into this db.
You can probably confirm to me that this isn't a good idea, right?
Could these additional fields, making `_users` non-standard, have an effect on per user databases, too?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "nickva (via GitHub)" <gi...@apache.org>.
nickva commented on issue #5436:
URL: https://github.com/apache/couchdb/issues/5436#issuecomment-2667086936
Thanks for reaching out, @Napsty.
I couldn't reproduce it on a dev cluster (`./dev/run --admin=adm:pass -n 1`) on 3.3.2 on macos
```
% curl -X PUT http://adm:pass@localhost:15984/_users/org.couchdb.user:jan -H "Accept: application/json" -H "Content-Type: application/json" -d '{"name": "jan", "password": "apple", "roles": [], "type": "user"}'
{"ok":true,"id":"org.couchdb.user:jan","rev":"1-bf68fe2945d35d64a984e4fa9458beab"}
% curl $DB
{"couchdb":"Welcome","version":"3.3.2","git_sha":"11a2340",...
```
I also cannot find any instances of `StringValidator` in our source mentioned in the error. There is a mention about a `city` as well? ```<<\"city\">>,\n {[{<<\"errorMessage\">>,\n ```. Is there a chance there is a wrapper or other code running in between Apache CouchCD and the client (a proxy)? Or maybe a custom VDU (validate_doc_update) function is loaded into the _users db?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Unable to create user in _users db (received undefined) [couchdb]
Posted by "nickva (via GitHub)" <gi...@apache.org>.
nickva commented on issue #5436:
URL: https://github.com/apache/couchdb/issues/5436#issuecomment-2676570680
> What is your recommendation in general? Is it a good or bad idea to use _users as application user database?
The `_users` db is a special "system" db that comes with some restrictions https://docs.couchdb.org/en/stable/intro/security.html#authentication-database. It would depend on your application whether using the system authorization db as your general users db would work. It's certainly possible to add extra fields to the docs, and even add an extra VDU to add more validation on top of the exiting one, but some of the restriction in place for `_users` may not work well.
> Could this function also be the cause (interfere) why a "per user db" is not created anymore?
I think it could, as the inserted user doc won't have the necessary fields (the extra ones required by the custom VDU)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org