OAuth 2.0 Authentication Authorization

In fact, before you do the service number of the binding login is also an OAuth authentication authorization

A simple look at the process by which a third party authenticates with OAuth: (taken from the network, with the diagram everyone should like ~)

The first step: users log on to third-party websites, such as using QQ login.

Second step: After clicking Login, will jump to QQ platform prompt input user name and password.

The third step: if the user name and password is correct, will prompt whether to accept the authorization, if the authorization is successful, the third party website can access your resources, QQ Avatar, user name, etc.

Certification and authorization process (including tripartite)

1, the service provider, the user to use the service provider to store protected resources, such as photos, videos, contacts list.

2. The user, the owner of the protected resource stored in the service provider.

3, the client, to access the service provider resources of third-party applications, usually the site. Before the authentication process, the client will request a client identity from the service provider.

The last part of the tongue twister ~

The user accesses the client's website and wants to manipulate the resources that the user holds in the service provider.

The client requests a temporary token from the service provider.

After the service provider verifies the identity of the client, it grants a temporary token.

After the client obtains the temporary token, the user is directed to the service provider's authorization page to request authorization from the user. In this procedure, the temporary token and the client's callback connection are sent to the service provider.

The user enters the user name and password on the service provider's Web page, and then authorizes the client to access the requested resource.

After authorization succeeds, the service provider directs the user back to the client's Web page and returns the authorized temporary credentials.

The client obtains an access token from the service provider based on the authorized temporary token.

The service provider grants a client access token based on the temporary token and the authorization of the user.

The client uses the obtained access token to access the protected resources that the user holds on the service provider. (The client can only access resource information for the user to whom it is authorized)

Some introductory text

First, what is the OAuth protocol

OAuth (open authorization) is an open standard.

Allow third-party websites to access various information stored by the user at the service provider, subject to user authorization.

This authorization does not require the user to provide a user name and password to the third party website.

OAuth allows a user to provide a token to a third-party web site, a token corresponding to a specific third-party site, and the token can only access specific resources for a specific period of time.

Second, the principle of oauth and authorization process

The three parties involved in the process of OAuth authentication and authorization include:

Service Providers: Users use the provider of services, generally used to save messages, photos, videos, contacts, files, etc. (such as Twitter, Sina Microwave, etc.).

User: User of the service provider

Third party: Usually a Web site that wants to access information stored by the user in the service provider.

For example, a Web site that provides photo printing services where users want to print their own web albums that exist in the service provider.

Prior to the certification process, third parties are required to request a unique identification of third party services from the service provider.

The process of OAuth authentication and authorization is as follows:

1, the user visits the third party website website, wants the user to store in the service provider's certain resources to carry on the operation.

2. The third party website requests a temporary token from the service provider.

3. After the service provider verifies the identity of the third-party website, it grants a temporary token.

4. After a temporary token is obtained from a third party website, the user is directed to the authorization page of the service provider requesting authorization from the user, and then this process sends the temporary token and the return address of the third party website to the service provider.

5. The user enters their username and password on the authorization page of the service provider, authorizes the third party website to access the corresponding resources.

6. After the authorization succeeds, the service provider directs the user to the return address of the third party website.

7. Third-party websites obtain access tokens from service providers based on temporary tokens.

8. The service provider grants the third-party website access token based on the token and the user's authorization.

9. Third party websites use access tokens obtained to access the corresponding user resources stored in the service provider.

OAuth 2.0 Authentication Authorization