设计Web平台认证

Question

I have some architecture question when building a complete web platform (a store for example). With consideration with Java, Google App Engine (GAE), Shiro and Restful api's

Consider I have these 3 main components of the platform:

• Front-end UI
• Admin UI
• Backend

These 3 components all run as separate applications in the GAE platform.

Front-end ui refers to the UI where 'users' use as the main UI to interact with the system, designed with Javascript and calls into the backend by Javascript

Admin UI refers to the UI used by admins to administer the platform, its users and its contents.

Backend , is the Restful server/service that both the Front-end UI and Admin-UI connects to, which exposes /user api's and /admin api's and api that complete the actual logic of the web service provided.

My question would be, where does authentication fits it, if I put the authentication in the backend, how will work with the front-end authentication. Say user logs in by email or by social login (oauth etc.) do I need to provide the Front-end its own authentication then forward to the Backend or in the Front-end this should be just UI and all operation such as login/logout must be through the backend.

If I use Shiro, how can this be achieved. I really prefer that the front-end UI be minimal as possible, of even just be a Single-Page-Application (SPA) or something like that. With this, what should be the binding for both the Front-end UI and the backend (considering they are both different GAE application) in terms of authentication

Answer 1

Consider this more a proposal and not an answer. I understand that your question is about Java version of GAE, but you can always get inspired by other implementations. Gae-init is a web application framework, that demonstrates a majority of good practices. As a contributor I find it distilled knowledge of the last years and an excellent starting point for initializing a large scale web app. I am pretty confident that you will not encounter any problems with Python implementation ;)