发送用户名和密码到google oauth认证
我正在 Android 中开发一个应用程序，它提供有关不同地方的信息。我已经将这些地方的图像存储在 picasa 中并使用 google api 检索它们，为此我为保存图像的用户创建了一个新的 google 帐户。
问题是当我启动 oauth 进程来获取令牌时，我得到一个新的网页，要求输入用户名和密码。由于这是技术用户，所有最终用户都不会知道用户和密码。
有没有办法将用户名和密码与其他 oauth 值（client_id、secret_id、redirect_uri 等）一起发送？
谢谢
I'm developping an application in android that provides information about different places. I've though of storing images of these places in picasa and retrieve them using the google apis, for this I created a new google account for the user holding the images.
The problem is when I start the oauth process for obtaining the token, I got a new web page asking for the username and password. As this is a technical user, all the end users will not know about the users and pwd.
Is there a way to send the username and password together with the other oauth values (client_id, secret_id, redirect_uri ,...?
Thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Google Oauth 身份验证是一个三足过程：
在此过程的第二阶段需要用户名和密码，其中用户使用其登录凭据授权客户端应用程序访问其存储在谷歌服务器中的私有数据。
现在，@Luis 提出的问题是，有没有办法将用户名和密码与其他 oauth 值一起发送？答案是否定的。无法在授权标头或授权 URI 的查询参数中发送用户名和密码。原因是用户应该始终意识到客户端（即您的应用程序）正在使用用户的数据。因此，用户始终会被重定向到要求他/她提供登录凭据的网页。这还允许用户为应用程序设置关于其私人数据的访问控制的限制。
如果允许应用程序存储和发送用户登录凭据以及 Oauth 授权标头，那么用户将永远不会知道应用程序正在使用其私有数据，也无法为应用程序设置任何类型的限制。
希望这个解释有帮助。
Google Oauth authentication is a three legged process:
Username and password is required at the second stage of this process where the user, by using his login credentials, authorize the client application to access its private data stored in the google server.
Now to the question that @Luis raised which is, is there a way to send the username and password together with the other oauth values? The answer is No. It is not possible to send the username and password in the Authorization header nor in the query parameter of the authorization URI. The reason being the user should always be made aware that the client (which is your application) is using the user's data. Hence the user is always redirected to the webpage where he/she is asked to provide the login credentials. This also allows the user to set restrictions with respect to access control on his private data, for the application.
If the application is allowed to store and send the user login credentials along with the Oauth Authorization headers, then the user will never know that the application is using its private data nor can it set any sort of restrictions for the application.
Hope this explanation helps.
尝试将您的照片放入 Picasa 网络相册的公共图库中，在这种情况下，无需用户帐户即可访问照片。
try to put your photos in public gallery in Picasa web albums, in this case there is no need of user account for accessing the photos.
如果您想避免显示登录对话框，可以尝试使用
AccountManager获取 OAuth 令牌。这将使用保存的 Google 帐户用户名和密码在幕后有效地执行相同的操作。当然，在此之前需要在设备上注册帐户。这是一个简短的描述，您只需找到 Picasa 的正确范围并将其作为令牌类型传递： http://developer.android.com/training/id-auth/authenticate.html您可以使用用户名和密码 ClientLogin，但已被弃用，因此在新项目中使用它不是一个好主意。
If you want to avoid showing the login dialog, you can try to get an OAuth token using the
AccountManager. That will effectively do the same thing behind the scenes, using the saved username and password for the Google account. Naturally, the account needs to be registered on the device before that. Here is a brief description, you just need to find out the right scope for Picasa and pass it as the token type: http://developer.android.com/training/id-auth/authenticate.htmlYou can get an authentication token using an username and password with ClientLogin, but has already been deprecated, so it's not a good idea to use it in new projects.