java 如何使用 oAuth 对 Restful Web 服务进行身份验证
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6061571/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to authenticate restful web service using oAuth
提问by sudo
I want to do authentication in RESTful web service for every request. I have read scope about OAuth in website. What should I store in database or which token key or access key need to check with database? I have REST web serivce and android app to call web serivce. So, Web service is served as a Service Provider, UserLogin is user and Android application as a Consumer like describe in Oauth site. So, if user request from android like
我想在 RESTful Web 服务中为每个请求进行身份验证。我在网站上阅读了有关 OAuth 的范围。我应该在数据库中存储什么或者哪个令牌密钥或访问密钥需要与数据库核对？我有 REST 网络服务和 android 应用程序来调用网络服务。因此，Web 服务作为服务提供者，UserLogin 是用户，Android 应用程序作为消费者，就像 Oauth 站点中描述的那样。所以，如果用户从 android 请求
GET /username/a.jpg HTTP/1.1
Host: localhost:8080
Authorization: OAuth realm="http://localhost/username/a.jpg",
oauth_consumer_key="dpf43f3p2l4k3l03",
oauth_token="nnch734d00sl2jdk",
oauth_nonce="kllo9940pd9333jh",
oauth_timestamp="1191242096",
oauth_signature_method="HMAC-SHA1",
oauth_version="1.0",
oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa%2FWM%3D"
But from server side which is web service how to check with database or which key will be use to check? is it signature?
但是从服务器端哪个是Web服务如何检查数据库或使用哪个密钥进行检查？是签名吗？
采纳答案by Lynn Crumbling
Read up on http://oauth.net/core/1.0/.. specifically Appendix A.2 through A.4. It describes the "handshake" that takes place when a service fails to get access, then redirects the user to the authentication website, then is returned back to the callback url.
阅读http://oauth.net/core/1.0/.. 特别是附录 A.2 到 A.4。它描述了当服务无法访问时发生的“握手”，然后将用户重定向到身份验证网站，然后返回到回调 url。
As you asked, in A.4, yes, the service then examines the signature and replies with an access token.
正如您所问的，在 A.4 中，是的，服务然后检查签名并使用访问令牌进行回复。
