{"action":"created","issue":{"url":"https://api.github.com/repos/apache/couchdb/issues/1176","repository_url":"https://api.github.com/repos/apache/couchdb","labels_url":"https://api.github.com/repos/apache/couchdb/issues/1176/labels{/name}","comments_url":"https://api.github.com/repos/apache/couchdb/issues/1176/comments","events_url":"https://api.github.com/repos/apache/couchdb/issues/1176/events","html_url":"https://github.com/apache/couchdb/pull/1176","id":298390192,"number":1176,"title":"Implement pluggable authentication and session support for replicator","user":{"login":"nickva","id":211822,"avatar_url":"https://avatars3.githubusercontent.com/u/211822?v=4","gravatar_id":"","url":"https://api.github.com/users/nickva","html_url":"https://github.com/nickva","followers_url":"https://api.github.com/users/nickva/followers","following_url":"https://api.github.com/users/nickva/following{/other_user}","gists_url":"https://api.github.com/users/nickva/gists{/gist_id}","starred_url":"https://api.github.com/users/nickva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickva/subscriptions","organizations_url":"https://api.github.com/users/nickva/orgs","repos_url":"https://api.github.com/users/nickva/repos","events_url":"https://api.github.com/users/nickva/events{/privacy}","received_events_url":"https://api.github.com/users/nickva/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-19T20:14:46Z","updated_at":"2018-02-20T06:38:42Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/apache/couchdb/pulls/1176","html_url":"https://github.com/apache/couchdb/pull/1176","diff_url":"https://github.com/apache/couchdb/pull/1176.diff","patch_url":"https://github.com/apache/couchdb/pull/1176.patch"},"body":"### Overview\r\n\r\nImplement pluggable authentication and session support for replicator\r\n\r\nPreviously replicator used only basic authentication. It was simple and\r\nstraightforward. However, with PBKDF2 hashing becoming the default it would be\r\nnice not to do all the password verification work with every single request,\r\nand instead take advantage of session (cookie) based authentication.\r\n\r\n ### Description\r\n\r\nThis commit implements session based authentication via a plugin mechanism.\r\nThe list of available replicator auth modules is configurable:\r\n\r\n```\r\n[replicator]\r\nauth_plugins = couch_replicator_auth_session,couch_replicator_auth_basic\r\n```\r\n\r\nThe plugins will be tried in order. The first one to successfully initialize\r\nwill end up being used for that endpoint (source or target).\r\n\r\nDuring the initialization callback, a plugin could decide it cannot be used in\r\nthe current context. In that case it signals to be \"ignored\". The plugin\r\nframework will then skip over it and try to initialize the next on in the list.\r\n\r\n`couch_replicator_auth_basic` effectively implements the old behavior. This\r\nplugin should normally be used as a default catch-all at the end of the plugin\r\nlist. In some cases, it might be useful to enforce exclusive use of\r\nsession-based auth and fail replication jobs if it is not available.\r\n\r\n`couch_replicator_auth_session` does most of the work of handling session based\r\nauthentication. On initialization, it strips away basic auth credentials from\r\nheaders and url to avoid basic auth being used on the server. Then it is in\r\ncharge of periodically issuing POST requests to `_session`, updating the\r\nheaders of each request with the latest cookie value, and possibly picking up\r\nnew session cookie if the server can issue them along with reglar responses.\r\n\r\nAs discussed in #1153 this work also removes OAuth 1.0 support. After\r\nserver-side support was removed, it had stopped working anyway since the main\r\noauth app was removed. However, with the plugin framework in place it would be\r\npossible for someone to implement it as a separate module not entangled with\r\nthe rest of the replicator code.\r\n\r\nFixes #1153\r\n\r\n### Checklist\r\n\r\n- [x] Code is written and works correctly;\r\n- [x] Changes are covered by tests;\r\n- [ ] Documentation reflects the changes[*]; \r\n\r\n[*] Will do it after the review stage.\r\n"},"comment":{"url":"https://api.github.com/repos/apache/couchdb/issues/comments/366881239","html_url":"https://github.com/apache/couchdb/pull/1176#issuecomment-366881239","issue_url":"https://api.github.com/repos/apache/couchdb/issues/1176","id":366881239,"user":{"login":"nickva","id":211822,"avatar_url":"https://avatars3.githubusercontent.com/u/211822?v=4","gravatar_id":"","url":"https://api.github.com/users/nickva","html_url":"https://github.com/nickva","followers_url":"https://api.github.com/users/nickva/followers","following_url":"https://api.github.com/users/nickva/following{/other_user}","gists_url":"https://api.github.com/users/nickva/gists{/gist_id}","starred_url":"https://api.github.com/users/nickva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickva/subscriptions","organizations_url":"https://api.github.com/users/nickva/orgs","repos_url":"https://api.github.com/users/nickva/repos","events_url":"https://api.github.com/users/nickva/events{/privacy}","received_events_url":"https://api.github.com/users/nickva/received_events","type":"User","site_admin":false},"created_at":"2018-02-20T06:38:42Z","updated_at":"2018-02-20T06:38:42Z","author_association":"CONTRIBUTOR","body":"Conducted a simple benchmark using couchdyno https://github.com/cloudant-labs/couchdyno\r\n\r\nTimed replicating 100k docs with PBKDF2 iterations set to 10k.\r\n\r\n```\r\n[couch_http_auth]\r\niterations = 10000\r\n```\r\n\r\n\r\n```\r\nrep.replicate_1_to_n_and_compare(1, normal=True, num=100000)\r\n```\r\n\r\nMaster took **1133** seconds and this PR took **574** seconds.\r\n\r\nThis should allow increasing the work factor to improve security without sacrificing replication performance.\r\n"}}
{"actor":{"display_login":"nickva"}}