Github user kxepal commented on the pull request:
https://github.com/apache/couchdb/pull/366#issuecomment-155241653
I'd played around with both @janl and Cloudant solutions and figure out the
cases when this feature becomes very useful. Sorry, I have to take back my
scepticism (:
However, important difference between these two implementations that Jan
require to delegate auth for real and existed CouchDB user while Cloudant
version acts more as Proxy Auth - you may delegate auth to any user, even
non-existed ones.
With given default 30 days timeout this makes things like token revoke very
hard to make. I only found the one way is to change the salt what is basically
means that I revoke all the tokens. With Jan's approach I can do this per user
basis. In the same time it requires my app to register in CouchDB every user
for which I will delegated auth with all the required roles. A little bit more
work to do, but it brings more order in the house.
Jan, please continue your work here.
However, it's still not clear how users with delegated auth will handle
expired token case (when we cannot prolong it automagically). CouchDB will
return 401 please auth, but to auth I have to ask some third party service.
Probably couch_httpd_auth with proper authentication_redirect will help here,
but it's a feature that is hard to make it work properly /: Thoughts?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
