Authentication and Authorisation for webmail project

[Saul Hazledine <co...@alienscience.org.uk>]

Hello,

I've been writing a simple webmail system as part of a hobby project. This
is being done using Ext-JS talking JSON to a simple java servlet that runs
relational database queries. I always felt that a relational database was
overkill for what I wanted to do. I'm also aware that most of the logic on
the server side is there to convert from JSON to JDBC and back.

This weekend I discovered CouchDB. It does the same as the servlet I wrote
-- only faster, more elegantly and with replication. Its such a good match
it would be rude not to use it.

However, I've got a few questions about how to go about moving from Java
servlet relational database thinking to CouchDB . I'm happy to RTFM if given
the location of FM.

The first question concerns how to separate different email users. Would it
be OK to have a database for each user? This would make querying fast but I
was wondering about the overhead of having say, 1000 databases handled by 1
CouchDB instance. If its too high I could go the more obvious way of using
an index on a userid field and having a single database for all email.

The second question is regarding authentication and authorisation. One user
shouldn't be able to read, edit or delete another users email. I can't work
out how to do this with CouchDB unless I use some sort of proxy that would
check username and password against the view being accessed or the data
being written. If this is the only route to go can anybody recommend a
lightweight language/server to use for this? My first guess would be Java
servlets although this would make each access go through the following
components:
  frontend webserver -> servlet engine -> couchdb
when ideally I'd want:
  frontend webserver -> couchdb
or in a perfect world:
  couchdb

Thanks in advance for any advice you can give.
Saul

Re: Authentication and Authorisation for webmail project

[Adam Wolff <aw...@gmail.com>]

Hi Saul,
The FM is pretty much the wiki:
http://wiki.apache.org/couchdb/

1000 databases for a single couchdb instance should be no problem.
http://mail-archives.apache.org/mod_mbox/couchdb-user/200904.mbox/%3ce2111bbb0904040820l360b28afv151403fe5ceb80c6@mail.gmail.com%3e

I may be mistaken, but I think there's currently no support for users
in couchdb. Here's the feature that's planned:
http://www.automatthew.com/2008/01/planned-security-model-for-couchdb.html

For now, I think you'll want to build an app in middleware and treat
couchdb as a replacement for an rdbms backend. You can use pretty much
any language/toolkit you want for this; Java would work well if you're
comfortable with it.

A


On Mon, Apr 20, 2009 at 5:53 AM, Saul Hazledine
<co...@alienscience.org.uk> wrote:
> Hello,
>
> I've been writing a simple webmail system as part of a hobby project. This
> is being done using Ext-JS talking JSON to a simple java servlet that runs
> relational database queries. I always felt that a relational database was
> overkill for what I wanted to do. I'm also aware that most of the logic on
> the server side is there to convert from JSON to JDBC and back.
>
> This weekend I discovered CouchDB. It does the same as the servlet I wrote
> -- only faster, more elegantly and with replication. Its such a good match
> it would be rude not to use it.
>
> However, I've got a few questions about how to go about moving from Java
> servlet relational database thinking to CouchDB . I'm happy to RTFM if given
> the location of FM.
>
> The first question concerns how to separate different email users. Would it
> be OK to have a database for each user? This would make querying fast but I
> was wondering about the overhead of having say, 1000 databases handled by 1
> CouchDB instance. If its too high I could go the more obvious way of using
> an index on a userid field and having a single database for all email.
>
> The second question is regarding authentication and authorisation. One user
> shouldn't be able to read, edit or delete another users email. I can't work
> out how to do this with CouchDB unless I use some sort of proxy that would
> check username and password against the view being accessed or the data
> being written. If this is the only route to go can anybody recommend a
> lightweight language/server to use for this? My first guess would be Java
> servlets although this would make each access go through the following
> components:
>  frontend webserver -> servlet engine -> couchdb
> when ideally I'd want:
>  frontend webserver -> couchdb
> or in a perfect world:
>  couchdb
>
> Thanks in advance for any advice you can give.
> Saul
>