AuthenticationRequestMode.Immediate 和 AuthenticationStatus.SetupRequired
我正在使用 DotNetOpenAuth 构建依赖方。到目前为止，一切都进行得相当顺利，但我有点坚持一件事；我不太确定在从存储的声明标识符立即执行检查后如何处理 AuthenticationStatus.SetupRequired 情况。
我将访问者声明的标识符存储在 cookie 中，如果他们未经身份验证就返回给我，但使用此 cookie，我会立即执行身份验证请求（因为我认为这是我应该做的）来检查OP 想到了我从访客那里获得的这个标识符。
似乎返回请求中返回的所有内容都是 State = SetupRequired...这是否意味着 OP 说“你很好...继续做你需要做的事情来保留这个claimed_identifier去”？或者当这种情况发生时我应该做点别的事情吗？
此外，当我立即向雅虎发出请求时，似乎会发生这种情况，但当我向谷歌发出相同的请求时，却不会发生这种情况。
什么给？
谢谢， 安德鲁
I'm using DotNetOpenAuth to build a Relying Party. So far everything has gone fairly smooth, but I'm a bit stuck on one thing; I'm not quite sure how to handle the AuthenticationStatus.SetupRequired case after performing a check immediate from a stored claimed identifier.
I'm storing my visitors' claimed Identifiers in a cookie, and if they return to me unauthenticated, but with this cookie, I perform an immediate authentication request (because I think this is what I'm supposed to do) to check what the OP thinks of this identifier I've gotten from a visitor.
It seems that all that comes back in the return request is the State = SetupRequired...does this mean that the OP is saying "you're good to go...go ahead and do what you need to do to keep this claimed_identifier going"? Or am I supposed to do something else when this happens?
Furthermore, this seems to happen when I make an immediate request to Yahoo, but not when I make the same request to Google.
What gives?
Thanks,
Andrew
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当您发送“立即”请求时，您是在询问 OP 是否愿意并且能够声明给定用户仍然登录到 OP。并非所有 OP 都支持此请求。那些不支持它的人和那些支持它但无法肯定响应的人（例如因为用户未登录）将 setup_required 返回给 RP。
在 RP 处，获取 SetupRequired 作为响应意味着“我并不是说用户是否已登录 - 您必须尝试使用 checkid_setup 再次进行身份验证”（这意味着在不使用立即模式的情况下重试。）
立即模式和立即模式之间的主要区别模式和“设置”模式的区别在于，在立即模式下，OP 根本不应该向用户呈现任何 UI——整个过程应该看起来像是对用户的重定向。在设置模式（即常规模式）下，OP 可以显示登录 UI 和/或“您确定要登录 [RP] 吗？”迅速的。如果 OP 需要显示此 UI，但由于是立即模式而无法显示，那么它唯一可以响应的是 setup_required。
When you send an "immediate" request, you're asking the OP if it is willing and able to say that a given user is still logged into the OP. Not all OPs support this request. Those that do not support it, and those that do support it but cannot respond affirmatively (because the user is not logged in for example) return setup_required to the RP.
At the RP, getting SetupRequired as a response means "I'm not saying the user is logged in or not -- you have to try authenticating again with checkid_setup" (which means try again without using immediate mode.)
The key difference between immediate mode and "setup" mode is that in immediate mode the OP is not supposed to present any UI to the user at all -- the entire process is supposed to just look like a redirect to the user. In setup mode (i.e. regular mode) the OP is allowed to display a login UI and/or a "are you sure you want to log into [RP]?" prompt. If the OP needs to display this UI and cannot because it is immediate mode, then the only thing it can respond with is setup_required.