ronnieroyston opened a new issue, #4663: URL: https://github.com/apache/couchdb/issues/4663
# Introduction I have implemented [JWT authentication](https://docs.couchdb.org/en/stable/api/server/authn.html#jwt-authentication). I noticed that: (1) Users configured as server administrators are not granted server administrator privileges when authenticating via JWT unless `"_admin"` is included in the JWT payload `roles` parameter. (2) JWT authenticated users having `"_admin"` included in the JWT payload `roles` parameter are allowed server admin privileges even though this user, or `sub` in JWT parlance, is not configured as a server admin. When I say "configured as a server admin" I mean that the user will be specified in CouchDB's response to the `_node/_local/_config/admins/` endpoint. ## Abstract Server admin privileges should be subject to highest security measures. Double checking a JWT _claim_ of a users `_admin` role against the list of configured system admins seems worth consideration. ## Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119.txt). ## Terminology **JWT**, JSON Web Token **Server admin**, user is listed in response to the `_node/_local/_config/admins/` endpoint --- # Detailed Description The solution would be to implement a verification of JWT claims specific to `roles:["_admin"]`. CouchDB shall validate any user presenting a JWT claim of `_admin`. # Advantages and Disadvantages The advantage of this additional security check is that a compromised JWT, while not probable, would not allow an attacker server admin status. # Key Changes This existing behavior of trusting `_admin` role claims is not explicitly documented therefore users may not notice the change. A meaningful HTTP error message such as "JWT _admin claim not configured for user" would enable adoption. ## Applications and Modules affected [chttpd] [admins] ## HTTP API additions A meaningful HTTP error message such as "JWT _admin claim not configured for user" ## HTTP API deprecations None. # Security Considerations CouchDB security would be enhanced by implementing this additional layer of security. # References https://docs.couchdb.org/en/stable/api/server/authn.html#jwt-authentication https://docs.couchdb.org/en/stable/intro/security.html#creating-a-new-admin-user # Acknowledgements Thanks to the CouchDB team for creating a great product! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
