iOS/Android authentication and security

Question

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?

Each user will have their own private database on the cloud. He will have his local couchdb on iOS/Android. My iOS/Android app will replicate between mobile and the cloud. Users can also access their data on the cloud from the web. I am using CouchDB authentication and there is no middle tier. When a user sign up for a new account, I will create a new database in the cloud with his account name. I compared Iris Couch and Cloudant and and chose Iris Couch because Cloudant doesn't give me admin privilege to achieve this.

My questions:

1. Is it a good idea or possible for the iOS/Android/Web client to have admin privilege to create a new database when they sign up for a new user account? I could hard code the admin username and password on the iOS/Android clients but that feels very wrong. For the web client, I won't have the option to hard code the admin password at all. Alternatively, I can setup a new machine in the cloud to monitor _users database changes and create new databases accordingly.
2. Shall I use the user's credential to replicate between mobile and cloud?
3. I am using Iris Couch for hosting. What is the best way to integrate Facebook authentication into my authentication model? I saw this plugin but does it require my own hosting and making changes to the server?

https://github.com/sander/CouchDB-Facebook-Authentication

Out of curiosity, I also look at Cloudant hosting. But it doesn't look like I can create CouchDB users and support my database-per-user model. I don't have admin access to _user database.

Answer 1

1. No. You shouldn't hardcode admin credentials into the client code. Have you considered running a server whose public interface has exactly one operation it supports (create_new_user)? Or implementing a stored procedure in the database to support this operation (if CouchDB supports stored procedures)?

2. I don't understand what you are asking here. Maybe more explanation is needed?

3. I don't know.

P.S. Since you have 3 questions, I suggest asking them separately. I think you are more likely to get useful responses that way.