简体繁体 English

oAuth2 - 具有相同用户凭据的多个令牌

[英]oAuth2 - Multiple tokens with the same user credentials

原文 2021-08-23 15:50:10 7 1 java/ oauth

We are calling and in-house API from our software package. Each client site has their own set of oAuth2 keys and secrets.我们正在通过我们的软件 package 拨打内部电话 API。每个客户端站点都有自己的一组 oAuth2 密钥和机密。

Our problem is that we want to get a unique token for each user but, with the current implementation, we are getting a unique token for each site (that expires every hour).我们的问题是我们想为每个用户获得一个唯一的令牌，但是在当前的实现中，我们为每个站点获得一个唯一的令牌（每小时过期）。 Since it would be impractical for each user to have his/her own set of credentials, is it possible to get a unique token for each user but still using the same key and secret?由于每个用户都拥有他/她自己的一组凭据是不切实际的，是否可以为每个用户获得一个唯一的令牌但仍然使用相同的密钥和秘密？

I have seen a post suggesting using the scope but that makes no sense.我看过一篇建议使用 scope 的帖子，但这毫无意义。 The scope is there to define user access, not token generation. scope 用于定义用户访问权限，而不是令牌生成。 Besides, I have tested it and it does not work.此外，我已经测试过它并且它不起作用。

[https://stackoverflow.com/questions/59022460/is-it-possible-to-have-multiple-valid-access-tokens-with-the-same-client-credent][1] [https://stackoverflow.com/questions/59022460/is-it-possible-to-have-multiple-valid-access-tokens-with-the-same-client-credent][1]

We also cannot use token_expiry since we don't know what the current token is (we do not persist it anywhere).我们也不能使用 token_expiry 因为我们不知道当前的令牌是什么（我们不会在任何地方持久化它）。

1 个解决方案

Use the scope=device_xx from WSO2. Initially my code did not work and it turned out that somebody changed the default ScopeWhitelist on our server to be "device:" instead of "device_".使用 WSO2 中的 scope=device_xx。最初我的代码不起作用，结果有人将我们服务器上的默认 ScopeWhitelist 更改为“device:”而不是“device_”。 Once changed back to the default, all code worked perfectly.一旦改回默认值，所有代码都可以正常工作。