OpenId 没有 http 重定向？
我想使用其中一种集中式身份验证系统，例如 OpenId、Google 或 Facebook 身份验证系统。然而我发现它们都使用 HTTP 重定向到相应的服务器来进行注册过程。
我的问题是，对于我的系统，我们想要提供不同的客户端，其中一些是独立的应用程序，因此 HTTP 重定向策略将不起作用，除非我在客户端中实现迷你浏览器（或类似的东西）。
是否可以以编程方式进行联合身份验证？
谢谢，
古斯塔沃。
I want to use one of the centralized authentication systems such as OpenId, Google or Facebook authentication systems. However I have found that all of them use HTTP redirects to the correspondent server for the sign-up part of the process.
My problem with this is that for my system we want to provide different clients, some of them stand-alone applications, and therefore the HTTP redirect strategy won't work unless I implement a mini-browser(or something similar) in my client.
It is possible to do this federated authentication in a programmatic way?
Thanks,
Gustavo.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这些系统的信任和安全依赖于浏览器。作为用户，只有当浏览器告诉我我已连接到我的提供商时，我才会输入我的凭据：通过指示安全连接并显示反网络钓鱼密封。
您可以在您的应用程序或您的网站上向我索要我的凭据，并代表我进行整个身份验证会话，但我为什么要把它们提供给您呢？您可以在应用程序中显示嵌入式浏览器或在网站上显示 iframe，但为什么我相信您不会捕获我的凭据？
然后还有一个便利：我的浏览器有一个来自我的提供商的 cookie，所以大多数时候我什至不需要输入凭据。
我认为独立应用程序的最佳方法是与应用程序服务器建立会话，然后启动浏览器，将用户带到您的 Web 服务器，并使用会话标识符来验证该会话。然后告诉他们身份验证已完成，他们可以返回应用程序。无论如何，使用 cookie 或存储的密码都会比在应用程序中输入凭据更快。
The trust and security of these systems relies on the browser. As a user, I only enter my credentials if the browsers tells me I am connected to my provider: by indicating a secure connection and by showing an anti-phishing seal.
You could ask me for my credentials in your application or on your website and conduct the entire authentication session on my behalf, but why would I give them to you? You could show an embedded browser in your application or an iframe on your website, but why would I trust you not to capture my credentials?
And then there is convenience: my browser has a cookie from my provider so I don't even need to enter credentials most of the time.
I think the best approach for a stand-alone application is to establish a session with your application server and then to launch a browser taking the user to your web server with the session identifier to authenticate that session. Then tell them that authentication is complete and they may return to the application. With cookies or stored passwords it will be faster than entering credentials into your application anyway.
根据 @aaz 的建议，根据您的应用程序对 Internet 的暴露程度，您可以构造一个 HttpListener 并将 return_to URL 指向您的侦听器。但不太可能在防火墙后面工作。
Building on what @aaz has suggested, depending on how exposed your application is to the Internet, you could construct an HttpListener and have the return_to URL point to your listener. Not likely to work behind firewalls, though.