java游戏客户端/mysql数据库的认证机制
我需要弄清楚如何针对另一台服务器上的 mySQL 数据库对从 C++ 游戏客户端连接的用户进行最佳身份验证，并且我计划编写一个 java Web 服务来完成此任务。
安全性是首要考虑的问题，我需要确保通过网络传输的数据是加密的，因此我将利用 SSL（最初我考虑使用 ws-security 进行消息级加密，但我认为它的开销太大）。
我真正需要弄清楚的是我应该提供什么样的身份验证机制。这些用户将提供用户名和密码，并向服务发出 Web 请求。
我还没有决定该服务应该是传统的 SOAP Web 服务还是 RESTful 服务。 Rest 背后的整个想法是使服务器无状态，并且由于客户端基本上将与服务建立会话，因此我认为这里没有使用 REST 的意义。
说了这么多，我真正需要确定的是如何准确地执行握手以及如何持续会话。
是否有任何流行的框架提供 API 来针对 mySQL 数据库执行此操作？
客户端再次向服务器提供 UN / PW，服务器需要解密它们（SSL 应该处理这一点），根据存储在 mysql DB 中的帐户信息对它们进行身份验证，然后返回某种哈希或类似的内容以便用户的会话可以持续存在，或者用户无需再登录即可发出其他请求。
有人可以推荐一个框架/一些阅读材料供我浏览吗？
I need to figure out how to best authenticate users which are connecting from a C++ game client, against a mySQL database on another server, and I plan on writing a java web service to accomplish this.
Security is of primary concern, I need to make sure that the data flowing across the wire is encrypted, so I'll be leveraging SSL (originally I thought about message level encryption using ws-security however I think it's too much overhead).
What I really need to figure out is what kind of authentication mechanism I should provide. These users will be supplying usernames and passwords, and will be issuing a web request to a service.
I haven't decided whether the service should be a traditional SOAP web service or a RESTful one. The whole idea behind rest is to make the server stateless, and since the client will basically be establishing a session with the service, I don't see a point in using REST here.
Having said all that, what I really need to nail down is how exactly to perform the handshake and how to persist the session.
Are there any popular frameworks out there that provide APIs to do this against a mySQL database?
Again the client will offer up a UN / PW to the server, which needs to decrypt them (SSL should take care of that), authenticate them against the account info stored in a mysql DB, and then return some kind of hash or something similar so that the user's session can persist or the user doesn't have to log in anymore to issue additional requests.
Could anyone recommend a framework / some reading material for me to glance over?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
让事情尽可能简单。
HTTP 已经是无状态的，并且登录后持续会话的想法已经很成熟（会话 cookie）。使用这个范例，你不会有任何麻烦。
您还可以受益于非常轻量级和开放的通信协议以及许多优秀的库，可以轻松序列化/反序列化常见的 REST 负载（例如 JSON 或 XML）。
REST 还意味着您可以轻松地与其他客户端使用同一服务器。
Keep things as simple as possible.
HTTP is already stateless, and the idea of a login followed by a continued session is well established (session cookie). Use this paradigm and you won't have any troubles.
You also get the benefit of a very light-weight and open communication protocol and many good libraries for easy serialization / deserialization of common REST payloads like JSON or XML.
REST also means that you can use the same server with other clients quite easily.
我会看一下 oauth：
http://developers.sun.com/ Identity/reference/techart/restwebservices.html
一个完善的模式是：
1. 登录&接收 oauth 令牌
2. 将令牌与用户的内部 ID 一起存储在数据库中（以及您希望存储的任何其他数据，例如令牌过期时间）。
3.发送token给客户端，客户端持久化token
4. 客户端为所有未来请求发送令牌
5. 服务器从令牌中获取用户信息
此方法应该适用于任何客户端语言和任何后端数据存储。
I'd take a look at oauth:
http://developers.sun.com/identity/reference/techart/restwebservices.html
A well established pattern is:
1. log in & receive an oauth token
2. store token in db with user's internal id (and any other data such as token expiration time you wish to store).
3. send token to client, client persists token
4. client sends token for all future requests
5. server fetches user info from token
This method should work well with any client language and any backend datastore.
我建议使用 REST。作为授权框架，您可以使用标准容器的 jdbc 或 JAAS 上的文件领域。如果登录/密码对成功，则将它们存储在客户端。之后，您可以使用每个请求提供的身份验证凭据来执行请求。我为此使用了球衣客户端。对于从/到 XML/json XStream 库的[反]序列化，“执行所有数据数学计算”。祝你今天过得愉快。
I would recommend to use REST. As authorization framework you can use standard container's jdbc or file realms on JAAS. If login/password pair is successful, store them at client side. After that, you can perform requests with auth credential supplied per request. I used jersey client for this. For [de]serialization from/to XML/json XStream library "do all dat math". Have a nice day.