我需要使用 OpenID 还是 OAuth 就足够了？
我正在开发一个基于网络的项目，我们利用用户的 Google feed 并将有关它们的一些信息存储在数据库中。我们不想让用户在我们这里创建帐户，而是让他们使用 Google 凭据登录。我很清楚我们需要 OAuth，但我想知道 OpenID 部分。我们是否可以通过 OAuth 访问有关用户的唯一可识别信息，以便在我们端跨会话跟踪他们的数据？如果是这样，使用 OpenID 有什么好处？
I'm working on a web based project where we make use of the user's Google feeds and we store some information about them in our database. We don't want to make users create accounts with us, but instead they sign in using their Google credentials. It's clear to me that we'll need OAuth, but I'm wondering about the OpenID part. Is there uniquely identifiable information about the user we can access via OAuth to keep track of their data across sessions on our end? If so, what would be the benefit of using OpenID?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
OpenID 和 OAuth（理论上，如果不是实际上）用于两个独立的功能：
OpenID 是管理身份和最小化帐户创建的方法。示例：无论走到哪里，我都想使用我的 Google 帐户登录。
OAuth 是一种以受控但开放/可互操作的方式共享用户信息的方法。示例：我希望允许 Twitter 访问我的 Google 联系人，而不必向 Twitter 提供我的 Google 用户名和密码。
这意味着在登录情况下您需要 OpenID。如果您需要访问用户的数据，则需要 OAuth。一些服务（例如 Twitter）选择通过 OAuth 进行登录，但这实际上是对协议的滥用。
然而，如今真正酷的是，一些提供商开始采用混合 OpenID + OAuth，以便帐户登录和信息共享授权可以在一个步骤中完成，而不是多个步骤。谷歌是这个领域的领导者之一。您可以查看这篇 Google 博文 全面了解他们所创造的内容。
希望这对您有所帮助，并让您更好地了解您正在寻找的内容。
OpenID and OAuth are (in theory if not in practice) used for two separate functions:
OpenID is means of managing identity and minimizing account creation. Example: I want to use my Google account to log in wherever I go.
OAuth is a means of sharing information about a user in a controlled yet open/interoperable fashion. Example: I want to allow Twitter to access my Google contacts without having to give Twitter my Google username and password.
What that means is that for login situations you want OpenID. If you need access to a user's data, you want OAuth. Some services, such as Twitter, have chosen to do login via OAuth, but that's a misuse of the protocol more than anything.
What's really cool these days, however, is that some providers are starting to do hybrid OpenID + OAuth so that the account login and information sharing authorization can be done in a single step instead of multiple steps. Google is one of the leaders in this arena. You can take a look at this Google blog post for a good overview of what they've been creating.
Hopefully that helps and gives you a better idea of what you're looking for.
我的一般建议是，为用户提供选择是一件好事。我使用 OpenID 登录该网站。它既快速又简单，因此我通过这种方式获得了更好的用户体验。
My general advice would be that providing users with the option is a good thing. I login to this site with OpenID. It's quick and simple, so I have a better user experience this way.