Google App Engine Datastore 和外部数据库的最佳选择?
我需要让 App Engine 应用与外部数据库通信并共享数据，
I need to get an App Engine app talking to and sharing data with an external database,
我能想到的最佳选择是将外部数据库数据输出到 xml 文件，然后在我的应用引擎应用程序中进行处理并将其存储在数据存储中，
The best option i can come up with is outputting the external database data to an xml file and then processing this in my app engine app and storing it inside the datastore,
虽然共享的数据是登录详细信息等敏感数据，因此将其输出到 xml 文件并不是一个好主意，但应用引擎应用程序是否可以直接查询数据库?或者是否有使用 xml 文件的安全选项?
although the data being shared is sensitive data such as login details so outputting this to an xml file is not exactly a great idea, is it possible for the app engine app to directly query the database? or is there a secure option for using xml files?
哦，我使用 python/django，外部数据库将托管在另一个域上
oh and im using python/django and the external database will be hosted on another domain
Google Apps 的 安全数据连接器 (SDC) 专为此类任务而设计——事实上，它甚至可以在其他数据库"位于防火墙之后(企业数据的常见情况)以及其他 Google Apps(文档、电子表格、...) 以及 App Engine.
Google Apps' Secure Data Connector (SDC) is designed for this kind of tasks -- indeed, it even works when the "other database" lives behind a firewall (a common case for enterprise data), and for other Google Apps (Docs, Spreadsheets, ...) as well as App Engine.
由于文档总结了一些事情，流程是:
As the docs summarize things, the flow is:
Google Apps 转发授权数据来自内部用户的请求Google Apps 域到 Google隧道协议服务器.
Google Apps forwards authorized data requests from users who are within the Google Apps domain to the Google tunnel protocol servers.
隧道服务器验证一个用户被授权制作请求指定的资源.谷歌隧道服务器已连接通过到 SDC 的加密隧道，在公司内部运行网络.
The tunnel servers validate that a user is authorized to make the request to the specified resource. Google tunnel servers are connected by an encrypted tunnel to SDC, which runs within a company's internal network.
隧道协议允许 SDC连接到 Google 隧道服务器，验证并加密数据流经互联网.
The tunnel protocol allows SDC to connect to a Google tunnel server, authenticate, and encrypt the data that flows across the Internet.
SDC 使用资源规则来验证如果用户被授权做一个对指定资源的请求.
SDC uses resource rules to validate if a user is authorized to make a request to a specified resource.
可选的 Intranet 防火墙可以是用于提供额外的网络安全.
An optional intranet firewall can be used to provide extra network security.
SDC 执行网络请求指定的资源或服务.
SDC performs a network request to the specified resource or services.
服务验证签名请求，检查凭据，以及如果用户被授权，则返回数据.
The service validates the signed request, checks the credentials, and if the user is authorized, returns the data.
如果您不必担心防火墙，并且没有任何安全问题，您可以通过直接使用 urlfetch(无隧道，无验证，没有加密，没有过滤，...)——但是您担心共享的数据是敏感数据，例如登录详细信息"表明情况并非如此.
If you don't have to worry about firewalls, and have no security worries whatsoever, you can simplify things (as Daniel's answer suggests) by just using urlfetch directly (no tunnels, no validation, no encryption, no filtering, ...) -- but your worry about "the data being shared is sensitive data such as login details" suggests that this is not the case.
这不是 XML 与其他格式的问题——问题是敏感数据不应该通过不受保护的渠道清晰"传输，也不应该提供给所有人和各种各样的人，并且有专门的基础设施处理通常更好加密、过滤和授权问题，就像 SDC 所做的那样，而不必在您自己的应用程序或专门的基础设施中间件中对所有这些进行编码(并使其完全安全和锁定).出于这些目的，SDC 非常有用，即使您只需要它的一小部分功能.
It's not a problem of XML vs other formats -- the problem is that sensitive data should not travel "in clear" over unprotected channels, nor be made available to all and sundry, and it's often nicer to have specialized infrastructure deal with encryption, filtering, and authorization problems, as the SDC does, rather than having to code all of this (and make it totally secure and locked-down) in your own app or specialized infrastructure middleware. For these purposes, the SDC can be very helpful, even if you only need a fraction of its functionality.