Provision CouchDB users with Auth0
In my personal finances tracking app I use PouchDB to store data locally in the browser and I wanted to sync the data to the server-side CouchDB, so that users can access their data from multiple devices.
Since all data in the app is private to user and users don’t share any data, the “Database per User” pattern felt natural to use. In this pattern we create new database and user in CouchDB for each new user in our app. We then use this personal CouchDB to sync data with PouchDB in the browser.
Auth0 for authentication
Cloudant — CouchDB as a Service
At first I found a great article by Ben Nadel, which shows how to create user and database in Cloudant after authentication in Auth0. Cloudant is now owned by IBM and offered as part of their IBM Bluemix cloud platform. They provide perpetually free Lite plan which is limited by throughput (e.g. 20 lookups,10 writes and 5 queries per second).
I’ve setup a test account with Cloudant and tried to sync data with PouchDB in the browser, but I was constantly getting time-out errors from Cloudant after just 2 connected clients doing live-replication.
The cheapest Cloudant plan after Lite costs $80 per month which I didn’t want to spent on a side project. After browsing around I’ve decided to host my own instance of CouchDB server at Google Cloud.
They provide one year free trial and a free tiny instance after the trial ends. It’s also easy to deploy basic CouchDB server with Bitnami Launcher. You will need to setup networking and load-balancing to make CouchDB server publicly available via HTTP, I will describe that process in more detail in a separate blog post.
Auth0 provides metadata for each user, which we can manipulate from our custom rules. We can also access this user metadata from our app after successful authentication and use it for data synchronization. High level provision workflow would look something like this:
- when user is authenticated, check if they have CouchDB credentials in their metadata
- if no CouchDB credentials stored in metadata - provision new user and databases in CouchDB server
- store CouchDB credentials in metadata
We need to create admin user in our CouchDB server and provide this admin credentials to our rule code.
There is a simple key-value configuration interface in Auth0 which allows you to do just that - set our
CouchDB host, admin user and password from Auth0’s web interface and access it in rule via
configuration global object.
Here’s the full code of the rule I use to provision CouchDB users and databases with Auth0. I actually create multiple databases for each user, but that is not important. I use request to perform plain HTTP requests to CouchDB. I also use uuid to generate random username and password.
As a first step I log in as admin to our CouchDB server and store auth cookie in a variable, which is later used for all HTTP requests. After that I create new user in CouchDB, new databases and set the newly created user as the only one having access to their databases. After that I update user’s metadata with newly created CouchDB credentials.