Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local couchdb on iOS/Android. My iOS/Android app will replicate between mobile and the cloud. Users can also access their data on the cloud from the web. I am using CouchDB authentication and there is no middle tier. When a user sign up for a new account, I will create a new database in the cloud with his account name. I compared Iris Couch and Cloudant and and chose Iris Couch because Cloudant doesn't give me admin privilege to achieve this.
My questions:
- Is it a good idea or possible for the iOS/Android/Web client to have admin privilege to create a new database when they sign up for a new user account? I could hard code the admin username and password on the iOS/Android clients but that feels very wrong. For the web client, I won't have the option to hard code the admin password at all. Alternatively, I can setup a new machine in the cloud to monitor _users database changes and create new databases accordingly.
- Shall I use the user's credential to replicate between mobile and cloud?
- I am using Iris Couch for hosting. What is the best way to integrate Facebook authentication into my authentication model? I saw this plugin but does it require my own hosting and making changes to the server?
https://github.com/sander/CouchDB-Facebook-Authentication
Out of curiosity, I also look at Cloudant hosting. But it doesn't look like I can create CouchDB users and support my database-per-user model. I don't have admin access to _user database.