SAAS/云 Web 应用程序和桌面应用程序之间的共享身份验证
一个简单的场景：
假设我们在云中有一个 Web 应用程序，允许用户使用 OpenID 进行注册。 （我愿意使用 Windows Live ID 作为替代方案） 他们可以登录并更新一些元数据，例如他们最喜欢的颜色是什么。
如果我现在想从桌面客户端获取此信息，我该怎么做？ 我可能必须公开 Web 服务才能查询此信息，但是身份验证怎么样？
有 DotNetOpenAuth 和 Windows Identity Foundation，我们还有 CardSpace 等
但我到底该从哪里开始呢？我需要其中哪一个？我需要全部 3 个吗？
那么STS呢，有OpenID / Windows Live ID的吗？
有人看到使用这些技术的示例可以实现我正在寻找的功能吗？ 有什么指点吗？
A simple scenario:
Let's say we have a Web Application up in the cloud that let users sign up using OpenID. (I'm open to use Windows Live ID as alternative)
They can log in and update some meta data, for example what their favorite color is.
If I now want to get this information from a desktop client, how do I do that?
I will probably have to expose a Web Service in order to query this information, but how about the authentication?
There's the DotNetOpenAuth and there's the Windows Identity Foundation, and we have CardSpace etc.
But where the heck do I start? Which of them do I need? Do I need all 3?
And what about STS, is there any for OpenID / Windows Live ID?
Does anyone seen a sample using these technologies that will do what I am looking for?
Any pointers?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在您的脑海中区分身份验证和授权的概念。您仅在您的网站上对用户进行身份验证。您可以使用 OpenID、InfoCard、STS 或用户名+密码来执行此操作。调用您的服务获取用户特定信息的客户端应用程序必须经过授权，这传统上意味着它们会要求用户提供用户名+密码，这是一种反模式，当您使用更强的或更强大的密码时，就会崩溃。正如您所看到的，替代凭据例如 OpenID 或 InfoCard。
授权应用程序应使用委托协议（例如 OAuth），该协议允许用户访问允许桌面应用程序访问用户私人数据的网页，而无需用户向应用程序公开其凭据。
DotNetOpenAuth 支持这个完整的场景。它附带示例 OAuth 和 OpenID 站点。我建议您查看项目模板它演示了 OpenID 登录（Web 表单甚至包括 InfoCard 登录作为一种选项）以及 OAuth 服务提供商，使其适用于 Web 用户并立即授权这些客户端应用程序。
Separate in your mind the concepts of authentication and authorization. You authenticate users at your web site only. You can do this with OpenID, InfoCard, STS, or username+password. Client apps that call your service for user-specific information must be authorized, which traditionally means they ask the user for their username+password, which is an anti-pattern, and breaks down when you use stronger or alternative credentials such as OpenID or InfoCard, as you're seeing.
Authorizing the app should use a delegation protocol such as OAuth, which allows the user to visit a web page that allows the desktop app to access the user's private data, without the user ever exposing their credentials to the app.
DotNetOpenAuth supports this full scenario. It comes with sample OAuth and OpenID sites. I recommend you check out either of the project templates which demonstrate OpenID login (and the web forms one even includes InfoCard login as an option) and also OAuth Service Provider, making it work for both web users and authorizing these client apps right out of the box.