Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

pass-through authentication #151

Open
wants to merge 1 commit into
from

Conversation

Projects
None yet
2 participants

Hi again,

I've added a very simple database authentication step based on an earlier discussion we had. When a request hits C-L, a get request is sent to underlying CouchDB database to verify that the user indeed has read access to it. This works by copying all headers from the original request onto the request going to CouchDB. By blindly copying all headers it works both for basic auth, cookies and what not. Note, that this uses an HttpClient, which does not use the credentials provided in couchdb-lucene.ini.

The rest of C-L continues to use the original httpClient, so there is no real change to the underlying flow of things, only a simple authenticating step is added (which perhaps could be made optional?)

Owner

rnewson commented Feb 22, 2012

It's a bit ugly but I coded up my thought here: https://github.com/rnewson/couchdb-lucene/compare/authenticate_users.

Yes, but your approach would only verify that the user is in fact a user in the CouchDB instance - not that he/she has access to the database being searched in (in the event that read-access has been limited to certain users/roles), which is the problem I'm trying to solve.

Also, your approach assumes that basic auth is being used, which is not always the case, especially when dealing with CouchApps for instance. Also, it will not work when deployed as a war to another servlet-container.

Your approach would be good for more general things, such as limiting access to the admin functionality to certain roles for instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment