我真的在试图理解OpenID和OAuth之间的区别?也许它们是完全不同的两件事?
当前回答
OpenId使用OAuth来处理身份验证。
通过类比,就像。net依赖于Windows API。你可以直接调用Windows API,但是它太宽了,太复杂了,方法参数太大了,你很容易犯错误/bug /安全问题。
OpenId/OAuth也是如此。OpenId依赖于OAuth来管理身份验证,但定义了特定的令牌(Id_token)、数字签名和特定的流。
其他回答
在阅读和做了一些工作后,我认为我需要知道的事情是:OpenID Connect, OAuth, JWT和SAML。
我来总结一下,可能会对大家有所帮助:
OpenID连接(OIDC):如果我们可以使用谷歌帐户登录一个网站,那么您使用的是OIDC。
OAuth:一个应用程序想要访问我的facebook联系人列表,并代表我做一些事情。如果我授权这个应用程序,那么我可能正在使用OAuth。
JWT: OAuth使用JWT, JWT (JSON Web令牌)-它只是一种令牌格式。JWT令牌是JSON编码的数据结构,包含有关发行者、主题(索赔)、到期时间等信息。对它进行签名以防止篡改和真实性,并且可以使用对称或非对称方法对它进行加密以保护令牌信息。JWT比SAML 1.1/2.0更简单,所有设备都支持它,而且它比SWT(简单Web令牌)更强大。
OAuth中的授权流程:
OAuth 2.0协议为授权用户和获取访问令牌提供了几个工作流。这取决于客户端的类型和体系结构,哪个流是最合适的。
下面是2个最常用的授权流程:
授权码:适用于包含客户端和服务器组件的第三方网站。
用户向安全登录网页输入凭据。 登录后,浏览器被重定向到一个特殊的URL(由客户端定义),并在URL中传递一个授权代码。 第三方服务器使用授权代码在后台通过另一个HTTP请求获取访问令牌。 从https://developers.video.ibm.com/api-basics-authentication/
注意:如果你有一个前端应用程序,服务器在浏览器中设置了cookie,那么你的浏览器中已经有了cookie,可以访问该网站。
客户端凭证:开发服务器端应用程序以管理其内容或设置的用户的最佳选择。
IBM有一个很好的指南:https://developers.video.ibm.com/api-basics-authentication 要了解所有其他流的优点和缺点:这里:https://www.geeksforgeeks.org/workflow-of-oauth-2-0/
SAML:也用作openid的替代品,但它是基于xml的。因为开发人员发现OIDC更容易使用,而且它更灵活(例如,与基于xml的SAML相比,与移动应用程序一起使用更容易),OIDC看起来将成为赢家。
OpenID连接(OIDC)与SAML:主要区别:
SAML transmits user data in XML format. OIDC transmits user data in JSON format. SAML calls the user data it sends a SAML Assertion. OIDC calls the data Claims. SAML calls the application or system the user is trying to get into the Service Provider. OIDC calls it the Relying Party. SAML is old, has more features, but OpenID is gaining more popularity as it is easier to implement, easier to use than XML based SAML But not all identity providers support OpenID or SAML, if the identity provider you want to integrate only supports SAML, then you have no choice.
想要更多OpenID vs SAML?读下面: https://www.onelogin.com/blog/real-difference-saml-oidc https://auth0.com/intro-to-iam/saml-vs-openid-connect-oidc/
想要更多吗?你可以读一下OAuth和OpenID的类比: http://cakebaker.42dh.com/2008/04/01/openid-versus-oauth-from-the-users-perspective/
我想谈谈这个问题的一个特定方面,如以下评论所述:
OAuth:在授予某些特性的访问权限之前,必须进行身份验证,对吗?所以OAuth =什么OpenId +授予访问某些功能?- Hassan Makarov 6月21日1:57
是的……也没有。答案很微妙,所以请耐心听我说。
当OAuth流将您重定向到目标服务(即OAuth提供者)时,您很可能需要在将令牌交还给客户机应用程序/服务之前使用该服务进行身份验证。然后,生成的令牌允许客户端应用程序代表给定用户发出请求。
注意最后一句话的一般性:具体来说,我写的是“代表给定用户”,而不是“代表您”。一个常见的错误是假设“拥有与给定用户拥有的资源交互的能力”意味着“您和目标资源的所有者是同一人”。
不要犯这样的错误。
虽然您确实使用OAuth提供者进行身份验证(例如,通过用户名和密码,或者SSL客户端证书或其他方式),但客户端获得的回报不应该被视为身份证明。例如,在一个流中,对另一个用户的资源的访问被委托给您(通过代理,OAuth客户端)。授权并不意味着身份验证。
要处理身份验证,您可能需要研究OpenID Connect,它本质上是OAuth 2.0设置的基础之上的另一层。以下是关于OpenID Connect(在我看来)最突出的一点(来自https://oauth.net/articles/authentication/):)
OpenID Connect is an open standard published in early 2014 that defines an interoperable way to use OAuth 2.0 to perform user authentication. In essence, it is a widely published recipe for chocolate fudge that has been tried and tested by a wide number and variety of experts. Instead of building a different protocol to each potential identity provider, an application can speak one protocol to as many providers as they want to work with. Since it's an open standard, OpenID Connect can be implemented by anyone without restriction or intellectual property concerns. OpenID Connect is built directly on OAuth 2.0 and in most cases is deployed right along with (or on top of) an OAuth infrastructure. OpenID Connect also uses the JSON Object Signing And Encryption (JOSE) suite of specifications for carrying signed and encrypted information around in different places. In fact, an OAuth 2.0 deployment with JOSE capabilities is already a long way to defining a fully compliant OpenID Connect system, and the delta between the two is relatively small. But that delta makes a big difference, and OpenID Connect manages to avoid many of the pitfalls discussed above by adding several key components to the OAuth base: [...]
The document then goes on to describe (among other things) token IDs and a UserInfo endpoint. The former provides a set of claims (who you are, when the token was issued, etc, and possibly a signature to verify the authenticity of the token via a published public key without having to ask the upstream service), and the latter provides a means of e.g. asking for the user's first/last name, email, and similar bits of info, all in a standardized way (as opposed to the ad-hoc extensions to OAuth that people used before OpenID Connect standardized things).
OAuth返回访问令牌,用于从资源服务器访问资源,OpenID返回JWT /加密令牌中关于资源的元数据细节
现在OpenID连接是最相关的,所以我将解释OpenID连接和OAuth 2之间的区别。
OpenID connect指定IDToken标准:https://openid.net/specs/openid-connect-core-1_0.html#IDToken
这是OpenID连接的主要贡献。因此,它指定了身份验证完成后响应中应该包含的内容。
IDToken需要是JWT令牌,并包含用户的信息,如用户id、用户名等。返回的信息取决于授权时传递的请求。它还包含令牌的过期日期,并且应该包含令牌的数字签名。此签名用于使用公钥验证令牌。
第二大差异与公钥有关。OpenID连接使用所谓的发现或众所周知的端点。它是一个公开开放的端点,只返回一个带有公钥和授权端点等值的JSON。
https://openid.net/specs/openid-connect-core-1_0.html#SelfIssuedDiscovery
因此OpenID本质上是与身份验证相关的,因为它指定了IDToken,这是通过检查数字签名和IDToken的过期日期来验证用户身份所必需的。
OAuth处理授权,特别是与作用域和验证资源服务器上的访问令牌相关的授权。
但是,正如这里所写的,OpenID使用OAuth 2授权进行身份验证。
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
身份验证请求是OAuth 2.0授权请求,它请求授权服务器对最终用户进行身份验证。
简而言之,尝试将OpenID视为使用JWT令牌的身份验证,将OAuth视为具有作用域的授权。
OpenID、OAuth、OpenID Connect的区别解释:
OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name and password) are sent to another server, B, that A trusts (at least, trusts for authenticating users). Indeed, server B makes sure that U is indeed U, and then tells to A: "ok, that's the genuine U". In OAuth, authorization is delegated: entity A obtains from entity B an "access right" which A can show to server S to be granted access; B can thus deliver temporary, specific access keys to A without giving them too much power. You can imagine an OAuth server as the key master in a big hotel; he gives to employees keys which open the doors of the rooms that they are supposed to enter, but each key is limited (it does not give access to all rooms); furthermore, the keys self-destruct after a few hours. To some extent, authorization can be abused into some pseudo-authentication, on the basis that if entity A obtains from B an access key through OAuth, and shows it to server S, then server S may infer that B authenticated A before granting the access key. So some people use OAuth where they should be using OpenID. This schema may or may not be enlightening; but I think this pseudo-authentication is more confusing than anything. OpenID Connect does just that: it abuses OAuth into an authentication protocol. In the hotel analogy: if I encounter a purported employee and that person shows me that he has a key which opens my room, then I suppose that this is a true employee, on the basis that the key master would not have given him a key which opens my room if he was not.
(源)
OpenID Connect与OpenID 2.0有何不同? OpenID Connect执行许多与OpenID 2.0相同的任务,但确实如此 以一种api友好的方式,在本地和移动设备上都可用 应用程序。OpenID Connect为健壮性定义了可选机制 签名和加密。而OAuth 1.0a和OpenID的集成 2.0需要一个扩展,在OpenID连接中,OAuth 2.0功能与协议本身集成。
(源)
OpenID connect will give you an access token plus an id token. The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider. In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance scopes, endpoint discovery, and dynamic registration of clients. This makes it easier to write code that lets the user choose between multiple identity providers.
(源)
谷歌是2.0版的
谷歌的OAuth 2.0 api可用于身份验证和 授权。本文档描述了我们的OAuth 2.0实现 用于身份验证,符合OpenID Connect 规范,并且是OpenID认证。在 “OAuth 2.0访问谷歌接口”也适用于本业务。如果 如果您想以交互方式探索此协议,我们推荐 谷歌OAuth 2.0游乐场。
(源)