PLJNS commented on issue #2867: URL: https://github.com/apache/couchdb/issues/2867#issuecomment-1301648282
I am also experiencing what @mikeymckay is reporting. I can create admins, but when I attempt to use them to create a user: ``` curl -X PUT http://localhost:5984/_users/org.couchdb.user:jan \ ;; subsititing my values -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d '{"name": "jan", "password": "apple", "roles": [], "type": "user"}' ``` I receive: `{"error":"unknown_error","reason":"undefined"}`, running an add user from Fauxton also fails, as does verifying the installation on step `Create View`. I have a suspicion that this is a problem with the "Bitnami" side of things, though that's only a guess. ``` [error] 2022-11-03T05:03:05.683431Z [email protected] <0.521.0> -------- OS Process Error <0.522.0> :: {os_process_error,{exit_status,139}} [notice] 2022-11-03T05:03:08.330962Z [email protected] <0.374.0> -------- couch_replicator_clustering : cluster stable [notice] 2022-11-03T05:03:08.335963Z [email protected] <0.401.0> -------- Started replicator db changes listener <0.540.0> [info] 2022-11-03T05:03:08.336856Z [email protected] <0.542.0> -------- open_result error {not_found,no_db_file} for _replicator [error] 2022-11-03T05:03:10.648455Z [email protected] <0.513.0> -------- rexi_server: from: [email protected](<0.509.0>) mfa: fabric_rpc:update_docs/3 exit:{timeout,{gen_server,call,[couch_proc_manager,{get_proc,{doc,<<"_design/_auth">>,{1,[<<117,58,224,21,122,139,26,34,51,159,60,14,244,241,191,25>>]},{[{<<"language">>,<<"javascript">>},{<<"validate_doc_update">>,<<"\n function(newDoc, oldDoc, userCtx, secObj) {\n if (newDoc._deleted === true) {\n // allow deletes by admins and matching users\n // without checking the other fields\n if ((userCtx.roles.indexOf('_admin') !== -1) ||\n (userCtx.name == oldDoc.name)) {\n return;\n } else {\n throw({forbidden: 'Only admins may delete other user docs.'});\n }\n }\n\n if (newDoc.type !== 'user') {\n throw({forbidden : 'doc.type must be user'});\n } // we only allow user docs for now\n\n if (! newDoc.name) {\n throw({forbidden: 'doc.name is required'});\n }\n\n if (!newDoc.roles) {\n throw({forbidden: 'doc.roles must exist'});\n }\n\n if (!isArray(newDoc.roles)) {\n throw({forbidden: 'doc.roles must be an array'});\n }\n\n for (var idx = 0; idx < newDoc.roles.length; idx++) {\n if (typeof newDoc.roles[idx] !== 'string') {\n throw({forbidden: 'doc.roles can only contain strings'});\n }\n }\n\n if (newDoc._id !== ('org.couchdb.user:' + newDoc.name)) {\n throw({\n forbidden: 'Doc ID must be of the form org.couchdb.user:name'\n });\n }\n\n if (oldDoc) { // validate all updates\n if (oldDoc.name !== newDoc.name) {\n throw({forbidden: 'Usernames can not be changed.'});\n }\n }\n\n if (newDoc.password_sha && !newDoc.salt) {\n throw({\n forbidden: 'Users with password_sha must have a salt.' +\n 'See /_utils/script/couch.js for example code.'\n });\n }\n\n var available_schemes = [\"simple\", \"pbkdf2\", \"bcrypt\"];\n if (newDoc.password_scheme\n && available_schemes.indexOf(newDoc.password_scheme) == -1) {\n throw({\n forbidden: 'Password scheme `' + newDoc.password_scheme\n + '` not supported.'\n });\n }\n\n if (newDoc.password_scheme === \"pbkdf2\") {\n if (typeof(newDoc.iterations) !== \"number\") {\n throw({forbidden: \"iterations must be a number.\"});\n }\n if (typeof(newDoc.derived_key) !== \"string\") {\n throw({forbidden: \"derived_key must be a string.\"});\n }\n }\n\n var is_server_or_database_admin = function(userCtx, secObj) {\n // see if the user is a server admin\ n if(userCtx.roles.indexOf('_admin') !== -1) {\n return true; // a server admin\n }\n\n // see if the user a database admin specified by name\n if(secObj && secObj.admins && secObj.admins.names) {\n if(secObj.admins.names.indexOf(userCtx.name) !== -1) {\n return true; // database admin\n }\n }\n\n // see if the user a database admin specified by role\n if(secObj && secObj.admins && secObj.admins.roles) {\n var db_roles = secObj.admins.roles;\n for(var idx = 0; idx < userCtx.roles.length; idx++) {\n var user_role = userCtx.roles[idx];\n if(db_roles.indexOf(user_role) !== -1) {\n return true; // role matches!\n }\n }\n }\n\n return false; // default to no admin\n }\n\n if (!is_server_or_d atabase_admin(userCtx, secObj)) {\n if (oldDoc) { // validate non-admin updates\n if (userCtx.name !== newDoc.name) {\n throw({\n forbidden: 'You may only update your own user document.'\n });\n }\n // validate role updates\n var oldRoles = (oldDoc.roles || []).sort();\n var newRoles = newDoc.roles.sort();\n\n if (oldRoles.length !== newRoles.length) {\n throw({forbidden: 'Only _admin may edit roles'});\n }\n\n for (var i = 0; i < oldRoles.length; i++) {\n if (oldRoles[i] !== newRoles[i]) {\n throw({forbidden: 'Only _admin may edit roles'});\n }\n }\n } else if (newDoc.roles.length > 0) {\n throw({forbidden: 'Only _admin may set roles'});\n }\n }\n\n // no system roles in users db\n for (var i = 0; i < newDoc.roles.length; i++) {\n if (newDoc.roles[i] !== '_metrics') {\n if (newDoc.roles[i][0] === '_') {\n throw({\n forbidden:\n 'No system roles (starting with underscore) in users db.'\n });\n }\n }\n }\n\n // no system names as names\n if (newDoc.name[0] === '_') {\n throw({forbidden: 'Username may not start with underscore.'});\n }\n\n var badUserNameChars = [':'];\n\n for (var i = 0; i < badUserNameChars.length; i++) {\n if (newDoc.name.indexOf(badUserNameChars[i]) >= 0) {\n throw({forbidden: 'Character `' + badUserNameChars[i] +\n '` is not allowed in usernames.'});\n }\n }\n }\n">>}]},[],false,[]},{<<"_design/_auth">>,<<"1-753ae0157a8b1a22339f3c0ef4f1bf19">>}},5000]}} [{gen_ server,call,3,[{file,"gen_server.erl"},{line,247}]},{couch_query_servers,get_ddoc_process,2,[{file,"src/couch_query_servers.erl"},{line,630}]},{couch_query_servers,with_ddoc_proc,2,[{file,"src/couch_query_servers.erl"},{line,525}]},{couch_query_servers,validate_doc_update,5,[{file,"src/couch_query_servers.erl"},{line,368}]},{couch_db,'-validate_doc_update_int/3-lc$^0/1-0-',5,[{file,"src/couch_db.erl"},{line,914}]},{couch_db,'-validate_doc_update_int/3-fun-1-',3,[{file,"src/couch_db.erl"},{line,917}]},{couch_stats,update_histogram,2,[{file,"src/couch_stats.erl"},{line,102}]},{couch_db,'-prep_and_validate_updates/6-fun-1-',3,[{file,"src/couch_db.erl"},{line,1014}]}] [notice] 2022-11-03T05:03:10.659312Z [email protected] <0.487.0> 95d609dc5c 34.97.188.226:5984 24.185.35.19 admin PUT /_users/org.couchdb.user:jan 500 ok 5096 ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
