Non-Admin User-Authentication at couchDB

Question

I am somewhat on the rope with couchdb. I'd like to expose my database to the internet. So what i learned and whats obvious, is that adminparty is no good idea.

So I am planning to create unprivileged users for each database who are allowed to CRUD documents within a single database. CouchDB will be proxy by an Apache2 over SSL.

What I did so far is that I created the users by creating docs in _users.

A user-doc looks like this:

{
   "_id": "org.couchdb.user:xxx",
   "_rev": "1-0eb034d6789ff52f8c1a414510983108",
   "type": "user",
   "name": "xx",
   "roles": [
       "xxx"
   ],
   "password_sha": "xxx",
   "salt": "xxx"
}

The I created a HTML-Form which actually worked for admin-Users already. The HTML-Form posts the credentials to /_session.

<!-- language-all: lang-html -->
<FORM action="http://example.com:5984/_session" method="POST" name="logonForm">
<INPUT type="hidden" name="destination" value="http://excample.com:5984/_session">
<p >Benutzername:<br><INPUT type="text" id="name" name="name" size="28" maxlength="256"></p>
<p >Kennwort:<br><INPUT type="password" autocomplete="off" id="password" name="password" size="28" maxlength="256">&nbsp;&nbsp;
<INPUT type="submit" value="Anmelden" >
</FORM>

As mentioned this already works for admin users but not for regular users in /_users.

Access rights are granted at the database based on the role.

Has anybody any idea what went wrong?

If the form works for admin users, then it should also work for unprivileged users. That is your first problem to resolve. Can you provide more details about the login form and why it might work for admins but not unprivileged users? Thanks! — JasonSmith
I do not see the form. Would you please update your question and add it there? Thanks! — JasonSmith
Sorry, had some problems to insert the HTML-code. I updated the question. — Randy

Randy Randy · Accepted Answer · 2011-09-12T21:07:47

Finally I found the mistake:

It was a wrong gererated (without salt) SHA1 hash :-(

A very good documentation can be found here Security Features Overview

Non-Admin User-Authentication at couchDB

1 Answers