OAuth 2.0 / OpenID Connect - 关于使用 ID 令牌与使用访问令牌的概念问题
我对整个编程和身份验证/授权相当陌生，并且希望从根本上了解我在初级工作中所做的事情。
我不太清楚的一件事是：
- 我了解流程以及通过 OpenID Connect 获得的 ID 令牌是什么。
- 我还了解该令牌与我通过 OAuth 授权获得的访问令牌非常不同。访问令牌具有范围，我可以使用它对 API 进行调用。
现在有以下（常见？）场景： 我有一个应用程序（在我的例子中是一个机器人，但不是 nvm），通常需要登录（使用 OpenId Connect 进行身份验证）-->将用户重定向到我的 IdP 等 -->获取 ID 令牌
稍后我可能想代表用户发送一封电子邮件 - 因此我需要设置一些授权范围等。
现在通常在最先进的应用程序中，如何避免授权步骤中的登录窗口。 OFC，我们仍然需要请求对东西的许可，但我们不应该再次需要例如用户+密码。
有人可以向我解释这种情况背后的基本逻辑吗？ “记住”我已经进行了授权并通过进一步基于 OAuth 的交互保持该状态背后的核心思想是什么？通常如何使用登录会话？另外：管理会话等通常属于我的应用程序的范围，对吗？ OAuth 的哪些部分以及我作为开发人员的哪些部分？我希望得到一个一般性的、更概念性的答案:)
请原谅我可能不准确的措辞，我是新来的:)感谢任何帮助！
I am rather new to programming and authentication/authorization as a whole and want to fundamentally understand what I am doing in my junior job.
One thing that is not fully clear to me is the following:
- I understand the flow and what the ID-Token is I get with OpenID Connect
- I also understand that this token very different to the Access Token I get via OAuth authorization. The access token has scope and I can make calls against an API with it.
Now the following (common?) scenario:
I have an app (in my case a bot but nvm) that generally requires a Login (authentication wth OpenId Connect) --> redirects user to my IdP and so on --> get an ID Token back
Later on I might want to send an Email on the user´s behalf - so I need to set some authorization with scope and so on in motion.
Now normally in a state-of-the-art app, how is the login window in the authorization step-avoided. OFC, we still need to ask for permission to stuff, but we should not need e.g. user+pass again.
Can someone explain to me the basic logic behind such a scenario? What is the core idea behind "remembering" that I already did an authorization and keep that status with further OAuth-based interactions? What is generally the way to make use of a logged-in-session? And also: Managing the session, etc. is normally in the sphere of my app right? What´s part of OAuth and whats part of me as a dev? I am hoping for a general, more conceptual answer :)
Please excuse my maybe inaccurate wording, I am new here :) Appreciate any help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当用户最初进行身份验证时，客户端将收到访问令牌和刷新令牌。
使用访问和刷新令牌，客户端可以在后台（即使用户未登录）随时使用访问令牌调用电子邮件 API。
它可以永远这样做，直到用户停止访问或刷新令牌过期。
那么这里有很多配置选项需要处理。
When the user initially authenticates then the client will receives an access and a refresh token.
Using the access and refresh token, the client can then in the background (even when the user is not logged in) use the access token to call the Email-API whenever it likes to do.
It can do this forever, until the user either stops the access or the refresh token expires.
Then you have a lot of configuration options here to deal with.