pass-through authentication

[jalpedersen]

Hi again,

I've added a very simple database authentication step based on an earlier discussion we had. When a request hits C-L, a get request is sent to underlying CouchDB database to verify that the user indeed has read access to it. This works by copying all headers from the original request onto the request going to CouchDB. By blindly copying all headers it works both for basic auth, cookies and what not. Note, that this uses an HttpClient, which does not use the credentials provided in couchdb-lucene.ini.

The rest of C-L continues to use the original httpClient, so there is no real change to the underlying flow of things, only a simple authenticating step is added (which perhaps could be made optional?)

[rnewson]

It's a bit ugly but I coded up my thought here: https://github.com/rnewson/couchdb-lucene/compare/authenticate_users.

[jalpedersen]

Yes, but your approach would only verify that the user is in fact a user in the CouchDB instance - not that he/she has access to the database being searched in (in the event that read-access has been limited to certain users/roles), which is the problem I'm trying to solve.

Also, your approach assumes that basic auth is being used, which is not always the case, especially when dealing with CouchApps for instance. Also, it will not work when deployed as a war to another servlet-container.

Your approach would be good for more general things, such as limiting access to the admin functionality to certain roles for instance.