high level design from wiki

There are still many questions that need to be answered regarding 
this application.  They are all asked with their appropriate topic 
but summarized here:

  * Should the user management default be Apache Directory or a 
simple database?
  * How will access control be implemented?
  * Will the Web service just provide data for machine to machine 
exchanges or will it default to human readable?
  * Should the project impose a backend data storage mechanism and 
schema, or just WS/REST interfaces suitable for pluggable frontends?
  * Should we use JCR or a (relational) Database?
   * The proposal (below) now presumes JCR.  Are we losing anything 
by not having a relational database?

The photos and meta data will be exposed via a Web service.  During 
discussions on the lists regarding how the code should be written, 
the one thing that no one seemed to be able to agree on was how the 
photos should be displayed.  Some would like to see them in Flash, 
others AJAX, still others as a JSP library.  Exposing the information 
as a Web service allows for each of these display formats to be 
utilized.  Question: Will the Web service just provide data for 
machine to machine exchanges or will it default to being human 
readable?  If it only provides for machine to machine exchanges then 
a default option for display will need to be provided.  We plan on 
looking at the Tuscany SCA implementation to facilitate the WS.

The storage for all data will use Apache Jackrabbit and as logically 
follows Sling.  The actual node and property structure has yet to be 
determined.  Questions: Should the project impose a backend data 
storage mechanism and schema, or just WS/REST interfaces suitable for 
pluggable frontends?  Should we use JCR or a (relational) Database?

Access control should provide the option to mark photos as public 
(anyone), protected (invite only), or private (just the owner). 
Options for managing the invites for each user are LDAP or a simple 
database. Permission checking can be implemented in the backend as a 
Jackrabbit access manager or in an application layer. Candidate 
technologies are JAAS and JSecurity, which both allow for pluggable 
authentication.