Associating a Google App Engine custom subdomain with a user

I have an application running on GAE, and would like to allow the user to use a subdomai开发者_如何转开发n on their own google app domain (e.g. myapp.example.com) to host their own customized version of my app.

It's easy to add the subdomain... just add the app by id on their Google app, and assign it a custom subdomain.

But since I want to give them the ability to customize their site, I want to associate the custom subdomain with a user. This becomes a security issue, since I don't know how to associate the person that setup the custom subdomain with a user logged into my app.

I think I could do it if I joined the app market place ($100)... by adding a configuration step in the installation and asking for a admin user. Has anyone done this? Do I need to be part of the marketplace?

I could also ask the admin to add a TXT entry to the domain's DNS, and verify that she did it (the same way Google verifies domains). This would have to be done outside of GAE, since the GAE API doesn't support DNS queries.

Note that I can't just match the domain endings on the user login since multiple people from one domain (e.g. user1@example.com and user2@example.com) might be using my app, and I only want to allow the admin that setup the subdomain to be able to customize that subdomain.

Has anyone done this? Any solutions?

This is tough. You could use the Apps Marketplace, and you're right that it would allow you to solicit configuration information from admins before setting it up. That's likely your best option, and also allows you to expose your app to more users, as well as making single-signin possible.

If you don't want to do that, there are a couple of ways you could ask admins to prove ownership. You could ask them to create a resource with a URL you specify on their www subdomain (or any other subdomain your app doesn't serve off). You could also ask them to add your app to the domain twice, once under the one they want to serve off, and once under a validation subdomain that you make up.