ronnieroyston commented on issue #4663: URL: https://github.com/apache/couchdb/issues/4663#issuecomment-1619018951
There is value in validating that the `sub` is configured as a server admin. The particular server admin password can exist even if not used/read for JWT authentication. As an aside, understood regarding the provenance of the JWT handler. _Authorization_, or `role` based access, is configured on CouchDB no matter what, e.g. each database's `_security` endpoint, or _permissions_. Mapping users to CouchDB roles seems like it should always exist on CouchDB and developers can architect in this fashion _as-is_ via design documents as far as I understand. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
