rnewson commented on issue #4663: URL: https://github.com/apache/couchdb/issues/4663#issuecomment-1618983984
The JWT handler (and the much older proxy handler) exists to externalise authentication/authorization decisions, including whether a user has admin privileges. The CouchDB administrator needs to make several privileged changes to enable this behaviour. Enabling the handler iteself, and then populating `[jwt_keys]` they trust to issue JWT tokens. I'd be happy to merge an enhancement to the handler that rejects JWT tokens with the `_admin` role as an option (off by default for backward compatibility reasons), if you were so minded. I think what won't work is 'validating' the token against the `[admins]` in the .ini file as that only contains a (salted) password hash; the JWT obviously doesn't include the password that we'd hash to compare it against. Perhaps you have some other idea in mind for this double-check? (though it can't be solely on the _name_ of the admin). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
