Grails Secure Login Design Questions along with Library & DB Choice

Question

Hello,

Am planning on building user administration module using Grails and the Spring Security Core plug-in for Grails.

Also, am considering using MongoDB for the database system.

Question(s):

(1) What trade offs and benefits will my app gain by choosing MongoDB over MySQL or HSQLDB?

(2) Is it super easy to way to implement (meaning 3rd party Grails APIs or plug-ins and/or Spring APIs?) an app that does the following:

• New User Registration
• Captchas
• Confirmation E-mail
• Forgot Password Reset Mechanism
• Roles
• SSL

(3) Can anyone point to a tutorial that touches on how to do some of these things using Grails?

(4) Will it be necessary to use a standard RDBMS over a NoSQL system for my app's user administration module?

Thank you for taking the time to read this.

Answer 1

1. Not a NoSql expert but NoSql Storage are more efficent in diriect reads (the get method of grails domain classes) and are slower on complex join queries or has no support for agragation (max, min, avrg)
2. Grails Security UI plugin has it all
3. http://burtbeckwith.github.com/grails-spring-security-ui/docs/manual/index.html
4. Grails MongoDB plugin implements the GORM functionality for MongoDB so everything should be OK (not tested directly )

Answer 2

The Spring Security UI plugin handles New User Registration, Confirmation E-mail, and Forgot Password Reset. The Spring Security Core plugin handles roles of course, and has support for specifying which URLs require SSL (see the docs on channel support, section "17 Channel Security").

You can customize the signup workflow to include a captcha - I'd recommend using the reCAPTCHA plugin: http://grails.org/plugin/recaptcha

There's also a MongoDB plugin: http://www.grails.org/plugin/gorm-mongodb

All of the persistence used by the Core and UI plugins is overrideable, but uses GORM by default and assumes you're using an RDBMS. But it's simple to plug in your own if you use MongoDB or some other mechanism - for example see the docs on creating a custom UserDetailsService (section "11 Custom UserDetailsService" at http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/)