理解the Username-Password OAuth Authentication Flow

標籤：style   blog   http   color   使用   strong   

使用者名稱-密碼身分識別驗證流可用於在身分識別驗證，當使用者擁有使用者的憑據時。在這個流程中，使用者的憑據由應用程式使用，用以請求一個存取權杖，如下列步驟中所示。

此oauth身分識別驗證流來回傳遞使用者憑證。僅當必要時，使用此身分識別驗證流。沒有重新整理標記將發行。

 

 

1.The application uses the user’s username and password to request an access token. This is done via an out-of-band POST request to the appropriate Salesforce（客戶管理系統） token request endpoint, such as https://login.salesforce.com/services/oauth2/token. The following request fields（欄位） are required:

An example request body might look something like the following:

grant_type=password&client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&client_secret=1955279925675241571&username=testuser%40salesforce.com&password=mypassword123456

Salesforce verifies（驗證） the user credentials, and if successful, sends a response to the application with the access token. This response contains the following values:

An example response body might look something like:

{"id":"https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P","issued_at":"1278448832702","instance_url":"https://na1.salesforce.com","signature":"0CmxinZir53Yex7nE0TD+zMpvIWYGb/bdJh6XfOH6EQ=","access_token":"00Dx0000000BV7z!AR8AQAxo9UfVkh8AlV0Gomt9Czx9LjHnSSpwBMmbRcgKFmxOtvxjTrKW19ye6PE3Ds1eQz3z8jr3W7_VbWmEu4Q8TVGSTHxs"}

3.The application users the provided access token to access protected user data. Keep the Following considrations in mind when using the user-agent Oauth flow:

Since the user is never redirected to login at Salesforce in this flow, the user can’t directly authorize the application, so no refresh tokens can be used. If your application requires refresh tokens, you should consider using the Web server or user-agent OAuth flow.

 

轉載自：http://www.salesforce.com/us/developer/docs/api_rest/Content/intro_understanding_username_password_oauth_flow.htm