클라이언트 권한 부여, 인증 시스템, OAuth-JWT

Transcript

1. ௿ۄ੉঱౟ ӂೠ ࠗৈ ੋૐ/ੋо दझమ !1
2. ӝઓ੄ Api ࠁউ਷? !2
3. दр হҊ ә೧ࢲ ݄ ݅ٞ !3
4. ‘಴ળ’ ӏѺਵ۽ ٜ݅੗! !4
5. ‘಴ળ’ <Api-Token> !5
6. “ೲо ߉਷ ࢎਊ੗݅ API ܳ ࢎਊೡ ࣻ ੓׮.” !6
7. “Api ߑޙ ஠٘” !7
8. OAuth !8
9. { "access_token": "J1qK1c18UUGJFAzz9xnH56584l4", “refresh_token”: "SDAS2328asdVASd1238asdA", "expires_in": 3600, "scope": "*", "token_type": "bearer" } !9
10. ੋૐ, ੋоܳ ਤೠ Standard Protocol !10
11. “যڌѱ ೞݶ ൝যઉ ੓ח Application ٜ੄ ੋૐ ҙܻܳ ઺ঔীࢲ औѱ ೡ Ѫੋо” !11
12. “ਬ੷о ಕ੉झ࠘, ౟ਤఠ э਷ ৡۄੋ ࢲ࠺झ੄ ӝמਸ ׮ܲ জীࢲب ࢎਊೡ ࣻ ੓ѱ Ք !” !12
13. OAuth 1.0 (RFC 5849, 2007) OAuth 1.0 A OAuth 2.0 (RFC 6749, 2012) !13
14. OAuth 1.x ਊয ߸҃ ࢲߡ ৉ೡ ܻ࠙ ੋૐ ੺ର хࣗച ঐഐച ߑध ߸҃ (٣૑ణ ࢲݺ -> HTTPS) ׮নೠ ੋૐ ߑध ઁҕ ੼੼ ೐ۨ੐ਕ௼ ഋక۽ .. OAuth 2.x !14
15. !15
16. { "access_token": "J1qK1c18UUGJFAzz9xnH56584l4", “refresh_token”: "SDAS2328asdVASd1238asdA", "expires_in": 3600, "scope": "*", "token_type": "bearer" } ݽٚ ష௾җ ੿ࠁܳ ؘ੉ఠ߬੉झী ੷੢ೞৈ ഛੋ੉ ೙ਃೣ. !16
17. 1. ࠂ੟ೞ׮ 2. ޖѩ׮ !17
18. Third-Party App / ࢲ࠺झী ੽Ӕೞח ৻ࠗ জ੄ ੋૐ ߂ ӂೠ ҙܻী ੸೤ !18
19. JWT (JSON WEB TOKEN) !19
20. { "access_token": "J1qK1c18UUGJFAzz9xnH56584l4", "expires_in": 3600, "token_type": "bearer" } !20
21. Claim ӝ߈੄ ష௾ दझమ !21
22. Claim = ࢎਊ੗ী ؀ೠ ࣘࢿ !22
23. Claim = ࢎਊ੗ী ؀ೠ ࣘࢿ !23 { ‘id’: ‘teddy’, ‘group’: ‘admin’} eyDigJhpZOKAmTog4oCYdGVkZHnigJ ksIOKAmGdyb3Vw4oCZOiDigJhhZG1p buKAmX0=
24. !24
25. !25
26. ష௾ ੗୓о ੿ࠁܳ о૑Ҋ ੓ӝী, ష௾ਸ о૑Ҋ ࢲ࠺झա API ੽Ӕਸ ઁযೡ ٸ ߹ب੄ ੋૐ ࢲߡ ੘স੉ ೙ਃೞ૑ ঋਵݴ, ష௾ ੗୓ܳ ࢲߡীࢲ ҙܻೡ ೙ਃо হӝ ٸޙী ҳഅ੉ ࢚؀੸ਵ۽ ױࣽ೧૓׮. !26
27. !27 < ੌ߈ OAuth > < JWT >
28. )VNBSU$PNQBOZ
    ӣక਌