2

I am new to node and I want to start building the following application:

The app should be a catalog of services offered by certain businesses. Users should be able to start and track the status of processes along with listed services providers.

So there are four databases:

  1. Admins
  2. Users
  3. Businesses
  4. Processes

And three types of users:

  1. Admin = Me (Authentication: username+password)
  2. Business (Authentication: username+password)
  3. User (Authentication: facebook)

Admins should have CRUD permissions to all databases. Businesses can only perform CRUD to their own profile (provided service) and update relevant processes. Users can perform CRUD to their on going processes.

I read a lot about npm modules like everyauth, mongoose-auth, passport but I have difficulties understanding their relationships with databases like mongodb especially when I have three types of users with three different permissions and four databases. I dont know how pages can check for three different types of cookies.

Should I create three different login and regestration systems? If yes, how?

Can someone please help me out..not with code..but with a concept or a relevant tutorial.

Passport requires the following for username & password configuration:

What I can't understand is:

  1. Where is the resulting database?
  2. How can I connect a mongodb database that I can access later?
  3. How should the app.get() look like to redirect users to corresponding login page?
  4. How can I implement this for three different login pages (adminLogin, businessLogin, userLogin) with three corresponding databases (admin, business, user)?
  5. How can I check if correct type of cookie is available on three different home pages (adminHome, businessHome, userHome)?
4

1 回答 1

3

我的建议：

  1. 使用“快递”。
  2. 使用“护照”。请注意，“mongoose-auth”建立在“everyauth”之上，它们可以正常工作，但我喜欢“passport”中“strategies”概念的灵活性，“express”集成更好。您可以使用任何具有 Passport Local 策略的数据库/方法（如 LDAP）来存储凭据，这在护照教程中进行了说明。此外，Passport Facebook 策略已经定义并可以使用。
  3. 如果可能，请为三个用户组中的每一个设置单独的快速路由 (URL)。在同一条路由上管理多个身份验证策略变得看似复杂且不可靠。
  4. 企业或用户不太可能需要直接访问数据库。因此，数据库只需要一个网络服务器到数据库服务器的连接。因此，如果您的 Web 服务器是安全的，您可能根本不需要数据库身份验证，即使您确实需要它，该连接也仅供管理员使用。但是，您应该阅读这些Mongo 安全建议以了解潜在的安全问题。
于 2013-01-08T02:04:25.083 回答