考虑到未来的 OAuth 实现，我应该如何在 Tomcat 上实现会话管理/身份验证？
我正在开发一个网站，我计划严格使用 OAuth 进行用户身份验证。我以前从未实现过会话管理/用户身份验证；因此，很自然地，我正在阅读很多如何完成这项工作的方法。
我遇到的问题是，很多用于设置领域、身份验证器等操作的示例似乎依赖于用户/密码范例进行身份验证。使用 OAuth 的全部目的就是首先避免这种情况！
话虽如此；实际上，我现在并不是在寻找完整 OAuth 实现的示例。我明白我需要自己去理解这一点。但考虑到未来的 OAuth 实施；我应该如何暂时构建我的用户身份验证/会话管理，以便我能够继续开发我真正关心的网站上的功能？我想我可以为此把一些东西放在一起；但我只是担心将来我会硬塞 OAuth 实现，而不是现在做一些事情，让我能够为其奠定基本框架，然后继续处理其他事情。
所以;有谁知道在 Tomcat 7 上为 OAuth 奠定基础的好例子吗？例如，我应该使用哪种身份验证机制（基本、摘要等）或者我应该如何在数据库中表示用户凭据？
我知道这是一个含糊的问题；所以我并不期待有人站出来告诉我所有我需要知道的答案。我只是想在这里指出正确的方向。
I'm working on a web site and I plan to use strictly OAuth in for user authentication. I've never implemented session management/user authentication before; and so - naturally - I'm reading up on a lot of how tos to get this done.
The problem I'm running into is that a lot of examples out there for doing things like setting up your realm, authenticator, etc etc seem to rely on the user/password paradigm for authentication. The whole point of going for OAuth is to avoid this in the first place!
That being said; I'm actually not looking for examples of full OAuth implementations right now. I understand that I need to understand that for myself. BUT with a future OAuth implementation in mind; how should I structure my user authentication/session management FOR THE TIME BEING in a way that will allow me to move forward on developing the functionality on my site that I really care about? I suppose I could throw some stuff together for that; but I'm just afraid that down the road I will be shoe horning an OAuth implementation as opposed to do something now which allows me to lay down the basic framework for it and then move on to other things.
So; does anyone know of a good example of laying the groundwork for OAuth on Tomcat 7? For example, which authentication mechanism (Basic, digest, etc) I should use or how I should represent user credentials in my database?
I know that this is kind of a vague question; so I'm not expecting someone to come out and tell me all of the answers I need to know. I'm just looking to get pointed in the right direction here.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
也许 Spring Security 会有用？您的 web 应用程序可以利用 Spring Security 并使用您需要的任何登录机制（即，您现在可以执行默认的基于表单的身份验证或基本身份验证，并在准备好时用 OAuth 实现替换登录/身份验证部分），但是仍然有 Spring Security 管理对 web 应用程序中特定资源的授权。
有人还构建了OAuth for Spring Security，所以它可能是一个有用的除了您的网络应用程序之外。
Perhaps Spring Security would be useful? Your webapp could leverage Spring Security and use whatever login mechanism you need (i.e., you could do the default form-based authentication or Basic Auth for now, and replace the login/auth piece with an OAuth implementation when you're ready), but still have Spring Security manage authorization to particular resources in your webapp.
Someone has also built OAuth for Spring Security, so it may be a useful addition to your web app all around.