arangodb verify _users password

Question

How can I verify if a given password matches with password from collection _users in arangoDB?

I know it can be done with Foxx app and arangosh but I am not using them as I am using my own API in python. So I don't know how to access to the password and check if matches with the given password without using Foxx or arangosh.

Alan Plum Alan Plum · Accepted Answer · 2016-05-20T14:16:49

You shouldn't rely on the system _users collection for your own user logic. The collection is strictly intended for ArangoDB's own user objects, not for application-level user management.

If you really do want to use ArangoDB's own user management, the best way to expose that when authentication is disabled is to use the org/arangodb/users module inside ArangoDB (e.g. using Foxx). The module provides an isValid method that takes a username and password and returns a boolean indicating whether the combination is valid or not:

var users = require('org/arangodb/users');
controller.post('/checkpw', function (req, res) {
  var credentials = req.params('credentials');
  res.json({
    valid: users.isValid(
      credentials.username,
      credentials.password
    )
  });
})
.bodyParam('credentials', joi.object({
  username: joi.string().required(),
  password: joi.string().required()
}).required());

The users HTTP API currently doesn't expose this method, so this is the only way to do it without relying on extremely unstable implementation details (the format of the _users collection has changed throughout 2.x and the collection may change again in the future).

EDIT: ArangoDB 3.0 will likely add an API route that returns a token (rather than cluttering up the database with session objects) when supplied with a valid username and password. This should make it easier to integrate with the built-in user management but the caveats remain the same: ArangoDB users are primarily intended for API-level authorization, not for application logic.

arangodb verify _users password

2 Answers