Github user kxepal commented on the pull request:
https://github.com/apache/couchdb/pull/366#issuecomment-154824082
@janl What did I understand from this:
1. There are User, App and CouchDB
2. User runs auth on App as Jan
3. App requests CouchDB POST /_login_as/jan
4. CouchDB meanwhile must have this user created
5. CouchDB returns App auth_token
6. App returns user auth_token
7. User sets this auth_token as cookie and starts to communicate directly
with CouchDB
Is that correct?
Questions:
1. For this auth schema it seems I have to mirror App users into CouchDB in
order to make them auth and to revoke their token when I remove them. Is that
correct?
2. If its is why User cannot auth directly on CouchDB?
3. If this auth schema doesn't assumes direct User auth with CouchDB and
auth_token expires, what is the workflow for it refresh?
I think some use case would be nice to see.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
