Couchdb and proxy authentication

Question

I have been using couchdb for a long time and we authenticate through cookies auth. Now we would like to start testing proxy authentication but I don't quite understand how it works.

I already have it activated including the value "chttpd_auth, proxy_authentication_handler" in the section "chttpd / authentication_handlers:" but how do I indicate that the token x is for the user y?

I can't understand how it works

I hope someone can help me with an example. Thank you.

score 1 · Accepted Answer · edited Jun 09 '21 at 18:13

1

In proxy_authentication, you are doing authentication somewhere else. That somewhere else is a proxy, or to be more specific a reverse proxy.

For example, if you're just using a single user and using nginx as a proxy to couchdb, you set the required headers before request is passed to couchdb like:

location / {
    # pass to couchdb
    proxy_pass http://localhost:5984;

    # ... other configurations.

    # authentication header
    proxy_set_header    X-Auth-CouchDB-UserName 'someone';
    proxy_set_header    X-Auth-CouchDB-Roles    '_admin,staff';
    proxy_set_header    X-Auth-CouchDB-Token    'auth-token';
}

Couchdb will accept request with given username and roles. X-Auth-CouchDB-Token should be a hex encoded hmac of X-Auth-CouchDB-UserName using secret in couch_httpd_auth section in your configuration. It is not required unless proxy_use_secret is true, which is not the case by default (although it should it should be used in production).

In practice, you will need to create a proxy server that validates username (maybe with password). Only after the user is valid the request will be passed to couchdb with those headers attached.

edited Jun 09 '21 at 18:13

Keith Hughitt

4,860
5
49
54

answered Dec 11 '20 at 12:20

Mas Bagol

4,377
10
44
72

I see but what is token header value? Is there any way to calculate? – Goltra Dec 12 '20 at 13:36
Added explanation about the token. – Mas Bagol Dec 12 '20 at 16:44
Oh! I didn’t find this in doc... I will try .. now all have sense – Goltra Dec 12 '20 at 17:01
It's in the doc. it's just scattered all over the place. ;) – Mas Bagol Dec 12 '20 at 17:23
Hi again, I get it. Only add, for me and other than me lost with this subject, **hmac-sha1**. First I was trying with hmac-sha256 and doesn't work. For testing we can generate in https://www.freeformatter.com/hmac-generator.html. Thanks folks – Goltra Dec 13 '20 at 16:18

Couchdb and proxy authentication

1 Answers1