GitHub user mikewallace1979 opened a pull request:
https://github.com/apache/couchdb-couch/pull/20
Add users db security rules on clustered interface
Apply authentication_db security rules when authentication_db is on the
clustered interface (5984).
COUCHDB-2452
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/apache/couchdb-couch
2452-users-db-security-on-clustered-interface
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/couchdb-couch/pull/20.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #20
----
commit cad071cc0b5018bfd355ef49de8941e2d545900a
Author: Mike Wallace <[email protected]>
Date: 2014-11-10T23:59:07Z
Add _users DB callbacks when opening _users shards
The check to determine whether to add the callback functions for
_users DB operations was only checking the raw database name. When
using the authentication DB on the clustered database this meant
that this check would fail and the callbacks would not be added.
This commit checks the DB name (rather than the shard name) against
the value of chttpd_auth/authentication_db so that shards for
clustered authentication DBs have the appropriate callbacks added.
COUCHDB-2452 1/3
commit 2ed693836af73c284c1f394a3c908ff3fcc30f59
Author: Mike Wallace <[email protected]>
Date: 2014-11-11T00:06:19Z
Update auth DB docs via the auth module
Documents in the authentication DB were being updated directly
from couch_httpd_auth via couch_db:update_doc/3. This meant that
updates to documents with the authentication DB on the clustered
interface (5984) would fail.
This commit makes the auth module responsible for the document
update via a ?MODULE:update_auth_doc/1 function and add
couch_auth_cache:update_auth_doc/1 which proxies to
couch_db:update_doc/3.
COUCHDB-2452 2/3
commit 6266b95415f8c8d8cde49a8ce221e9d31ebf18b8
Author: Mike Wallace <[email protected]>
Date: 2014-11-13T18:02:05Z
Move admin ddoc check for _users DB to http layer
In order to restrict access to design documents in the
authentication DB to admins only we were checking whether a user
was admin in the couch_server callback. When running the auth DB
on the clustered interface this meant that admins could not read
the design doc because the user context was not being passed to
any of the calls to open the design doc.
One possible fix is to add the user context to all the clustering
code involving design doc access however given the amount of
plumbing here is fairly substantial the chances of getting it wrong
are rather high. The alternative is to move this check into the
http layer where we already have access to the user context.
This commit moves the admin check when accessing design docs in the
auth DB into couch_httpd_db (for the admin port).
A separate commit in couchdb-chttpd adds a similar check for
requests through the clustered port.
COUCHDB-2452 3/3
commit 4e24b4caef90ab5749f614e62965b5dbe58f5283
Author: Mike Wallace <[email protected]>
Date: 2014-11-12T15:39:14Z
Whitespace
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
