[英]What is the correct approach for authentication/authorization Native Android App using Thinktecture IdentityServer3
I develop a native android application that done it's authentication, authorization, getting resources using WebApi backend. 我开发了一个本地android应用程序,该应用程序完成了身份验证,授权,并使用WebApi后端获取资源。
After many discussions about what is the best and secure way to implement authentication and authorization using .NET technologies we decided to use Thinktecture's IdentityServer3 . 在讨论了什么是使用.NET技术实现身份验证和授权的最佳和安全方式的许多讨论之后,我们决定使用Thinktecture的IdentityServer3 。
Before i was follow this series to implement a token based authentication using Asp.NET Identity system, every thing was OK but after investigations i decide to decouple the authentication server and using Thinktecture's Identity Server. 在我按照本系列文章使用Asp.NET身份系统实现基于令牌的身份验证之前,一切都很好,但是经过调查,我决定取消身份验证服务器的耦合并使用Thinktecture的身份服务器。
So now i have a separated web apps hosted on azure one for resources and other for authentication using IdentityServer3 and one native Android client . 因此,现在我在Azure上托管了一个单独的Web应用程序,一个用于获取资源,另一个用于使用IdentityServer3和一个本机Android客户端进行身份验证。
My Android client application having an authentication using Facebook/Google, and i already implemented this before on android using Parse or separatly based on Facebook Android SDK & Google services 我的Android客户端应用程序具有使用Facebook / Google的身份验证,并且我之前已经在Android上使用Parse或基于Facebook Android SDK和Google服务分别实现了此功能
Also Users having roles. 还具有角色的用户。
Now i want to know if there is a correct approach for doing that from the authentication server perspective and also client android application perspective as there are many discussions about the configurations of identityserver3 with native apps also should i use a webview activity in android to handle connection with authentication server or using native java code with HTTP library like retrofit to send request and get response. 现在我想知道从身份验证服务器的角度以及客户端android应用程序的角度来看是否有正确的方法,因为关于身份服务器3与本机应用程序的配置的许多讨论也应该在android中使用webview活动来处理连接与身份验证服务器配合使用,或将本机Java代码与HTTP库配合使用(例如翻新)来发送请求和获取响应。
Also with Facebook, i already implemented authentication directly from android app using Facebook Android SDK and i can get the AuthToken and the approach that i think about is like shown in this question : 同样在Facebook上,我已经直接使用Facebook Android SDK从android应用程序实现了身份验证,我可以获得AuthToken,我认为的方法类似于此问题所示 :
If the Facebook API call from web server returns valid authentication, and the user id is equal to the one submitted by Android application, your server can trust the id (& you can be sure that the Android authentication real) 如果来自网络服务器的Facebook API调用返回了有效的身份验证,并且用户ID等于Android应用程序提交的用户ID,则您的服务器可以信任该ID(并且您可以确定Android身份验证是真实的)
Or should i depend only on backend identityserver to handle Facebook authentication? 还是我应该仅依靠后端身份服务器来处理Facebook身份验证?
you can use the hybrid flow (if you need access tokens and refresh tokens) , also You could use the implicit flow 您可以使用混合流(如果需要访问令牌和刷新令牌),也可以使用隐式流
just have alook at this topic 看看这个话题
and about how can you do it, Either, you can do it by doing a combination of web views and hybrid/implicit flow, or do the redirect style to the IdSvr login page. 关于如何执行此操作,可以通过组合使用Web视图和混合/隐式流来执行,也可以将重定向样式设置为IdSvr登录页面。 Using resource owner password flow
使用资源所有者密码流
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.