GVKun编程网logo

Passport.js：password-facebook-token策略，通过JS SDK登录，然后对护照进行身份验证？

17

如果您想了解Passport.js：password-facebook-token策略，通过JSSDK登录，然后对护照进行身份验证？的知识，那么本篇文章将是您的不二之选。同时我们将深入剖析#impor

如果您想了解Passport.js：password-facebook-token策略，通过JS SDK登录，然后对护照进行身份验证？的知识，那么本篇文章将是您的不二之选。同时我们将深入剖析#import "facebookSDK/FacebookSDK.h file not found"、AccessToken-->Password Grant、android-通过“单一登录”进行身份验证后,移至Facebook应用程序页面、angularjs – PassportJs.如何在没有重定向用户的情况下获得facebook重定向uri后调用passport.authenticate(‘facebook’)的各个方面，并给出实际的案例分析，希望能帮助到您！

本文目录一览：

Passport.js：password-facebook-token策略，通过JS SDK登录，然后对护照进行身份验证？

Passport.js：password-facebook-token策略，通过JS SDK登录，然后对护照进行身份验证？

我一直在寻找一种让我的客户使用facebook JS SDK授权的方法，然后以某种方式将此授权转移到我的节点服务器（以便它可以使用fb graph
api验证请求）

我偶然发现了：https :
//github.com/jaredhanson/passport-
facebook/issues/26

和

https://github.com/drudge/passport-facebook-
token

这似乎与护照-脸书完全不同

我假设是正确的：

一个人使用fb JS SDK登录，然后facebook-token令牌策略以某种方式从文档或主体对象中提取了令牌和fb id？

还是有其他合适的方法来实现这一目标？我就是想避免服务器SDK强制执行的重定向

答案1

小编典典

我本周花了几天时间，试图找出使用私有密码的Facebook身份验证的最佳方法，即使用passport.js-护照-facebook-令牌非常适合此操作。

您以为这是两种单独的身份验证策略是正确的。您不需要安装password-facebook即可使用passport-facebook-token。

如果您在客户端JS（或iOS等）中实现了Facebook身份验证，并且正在寻找一种使用用户的Facebook
authToken对API请求进行身份验证的方法，那么passport-facebook-token是一个非常好的解决方案。

Passport-facebook-token的工作原理完全独立于password-
facebook，并且在将请求传递给您的控制器之前，基本上处理了Facebook内部所需的重定向。

因此，要使用passport-facebook-token对API路由进行身份验证，您需要按照以下方式设置护照策略：

passport.use(''facebook-token'', new FacebookTokenStrategy({    clientID        : "123-your-app-id",    clientSecret    : "ssshhhhhhhhh"  },  function(accessToken, refreshToken, profile, done) {    // console.log(profile);    var user = {        ''email'': profile.emails[0].value,        ''name'' : profile.name.givenName + '' '' + profile.name.familyName,        ''id''   : profile.id,        ''token'': accessToken    }    // You can perform any necessary actions with your user at this point,    // e.g. internal verification against a users table,    // creating new user entries, etc.    return done(null, user); // the user object we just made gets passed to the route''s controller as `req.user`  }));

值得注意的是，User.findOrCreatepassword-facebook-token-token自述文件中使用的方法不是默认的mongo /
mongoose方法，而是一个您必须安装的插件。

要将此身份验证策略用作任何路由的中间件，您需要将其access_token作为URL参数或请求主体的属性传递给它。

app.get(''/my/api/:access_token/endpoint'',         passport.authenticate([''facebook-token'',''other-strategies'']),         function (req, res) {            if (req.user){                //you''re authenticated! return sensitive secret information here.                res.send(200, {''secrets'':[''array'',''of'',''top'',''secret'',''information'']});            } else {                // not authenticated. go away.                res.send(401)            }        }

注意 该access_token属性区分大小写并使用下划线。护照-facebook-
令牌的文档并不广泛，但是源代码确实经过了很好的注释并且非常易于阅读，因此，我建议您在此处进行深入了解。当然，这可以帮助我为护照的一些更一般的使用方法所用。

#import <FacebookSDK/FacebookSDK.h>

#import "facebookSDK/FacebookSDK.h file not found"

第一种可能： 从window下上传到mac 下 facebook sdk出错！【这个是系统的错误，只能从其他地方拷贝 FacebookSDK.framework 文件夹 就ok】，下图是正常状态，【不正常的状态下，这几个文件直接是物理文件了】

第二种可能 ，设置读取路径错误


在mac下 project下找到build setting ，再找 searchPath,点击Framework search paths 设置路径即可

"$(SRCROOT)/xxx/xxx/FacebookSDK.framework"

AccessToken-->Password Grant

AccessToken-->Password Grant

https://www.oauth.com/oauth2-servers/access-tokens/password-grant/

The Password grant is used when the application exchanges the user’s username and password for an access token. This is exactly the thing OAuth was created to prevent in the first place, so you should never allow third-party apps to use this grant.

A common use for this grant type is to enable password logins for your service’s own apps. Users won’t be surprised to log in to the service’s website or native application using their username and password, but third-party apps should never be allowed to ask the user for their password.

 

Request Parameters

The access token request will contain the following parameters.

  • grant_type (required) – The grant_type parameter must be set to “password”.
  • username (required) – The user’s username.
  • password (required) – The user’s password.
  • scope (optional) – The scope requested by the application.
  • Client Authentication (required if the client was issued a secret)

If the client was issued a secret, then the client must authenticate this request. Typically the service will allow either additional request parameters client_id and client_secret, or accept the client ID and secret in the HTTP Basic auth header.

 

Example

The following is an example password grant the service would receive.

POST /oauth/token HTTP/1.1
Host: authorization-server.com
 
grant_type=password
&username=user@example.com
&password=1234luggage
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx

See Access Token Response for details on the parameters to return when generating an access token or responding to errors.

 

 

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 77e99b5f-d31e-4379-a64c-ddc511d42781
grant_type=passwordusername=adminpassword=passwordundefined=undefined


  https://stackoverflow.com/questions/32616069/customizing-allowed-grant-types-with-oauthauthorizationserver

To allow only the grant types you want it''s enough to inherit from OAuthAuthorizationServerProvider. Then you need to override two methods:

  • ValidateClientAuthentication - to validate that the origin of the request is a registered client_id
  • GrantResourceOwnerCredentials - to validate provided username and password when the grant_type is set to password

For more information here is the documentation of GrantResourceOwnerCredentials method:

Called when a request to the Token endpoint arrives with a "grant_type" of "password". This occurs when the user has provided name and password credentials directly into the client application''s user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token". If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate. To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token. The application should take appropriate measures to ensure that the endpoint isn’t abused by malicious callers. The default behavior is to reject this grant type.

 

需要注意的是：

 

client_credentials

Called when a request to the Token endpoint arrives with a "grant_type" of "password".

This occurs when the user has provided name and password credentials directly into the client application''s user interface, and the client application is using those to acquire an "access_token" and optional "refresh_token".

If the web application supports the resource owner credentials grant type it must validate the context.Username and context.Password as appropriate.

To issue an access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated with the access token.

The default behavior is to reject this grant type. See also http://tools.ietf.org/html/rfc6749\#section-4.3.

 

经过测试，发现下面这个才是有效的

GET /Chuck_WebApi/oauth/token HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: ce49a101-df6e-4b7c-9217-e112b387b784
grant_type=client_credentialsusername=adminpassword=password

 换了另外一种

GET http://localhost/Chuck_WebApi/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
cache-control: no-cache
Postman-Token: 3b870eb3-1c29-4b5e-9dcd-297e3f582c27
User-Agent: PostmanRuntime/7.6.0
Accept: */*
Host: localhost
accept-encoding: gzip, deflate
content-length: 75
Connection: keep-alive

grant_type=password&username=admin&password=password&client_id=testClientId

 

android-通过“单一登录”进行身份验证后,移至Facebook应用程序页面

android-通过“单一登录”进行身份验证后,移至Facebook应用程序页面

我正在开发一个需要集成Facebook社交功能的应用程序.

我想要的是使用SSO(单一登录)功能,当用户按下我的应用程序中的按钮时,在用户身份验证后,Web视图将打开并在Facebook中向他显示​​我的应用程序页面,现在他可以像其他人一样身份验证用户身份.

我下载了Facebook SDK,并将其包含在我的项目中,我还在Facebook开发人员页面上签名了我的应用程序,并获得了app-id.

到目前为止,这是我的代码：

public class WebViewLike extends Activity {

    private static final String TAG = "WebViewLike";
    public static final String APP_ID = "1222222";
    private Facebook facebook = new Facebook(APP_ID);

    private WebView webView;
    private Activity myActivity;

    private final class WallWebChromeClient extends WebChromeClient {

        public void onProgressChanged(WebView view, int progress)   
        {
            myActivity.setTitle("Loading...");
            myActivity.setProgress(progress * 100);

            if(progress == 100)
                myActivity.setTitle(R.string.app_name);
        }
    }

    @Override
    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);
        requestwindowFeature(Window.FEATURE_PROGRESS);
        setContentView(R.layout.view_weblike);
        myActivity = this;

        facebook.authorize(this, new DialogListener() {
            @Override
            public void onComplete(Bundle values) {

                Log.d(TAG, "onComplete");
                Log.d(TAG, "facebook.getAccesstoken() " + facebook.getAccesstoken());
                Log.d(TAG, "facebook.getAccessExpires() " + facebook.getAccessExpires()); 

                //Load the given URL
                webView.loadUrl(getFacebookWallUrl());
            }

            @Override
            public void onFacebookError(FacebookError error) {Log.d(TAG, "onComplete");}

            @Override
            public void one rror(DialogError e) {Log.d(TAG, "onComplete");}

            @Override
            public void onCancel() {Log.d(TAG, "onComplete");}
        });

        initWebView();
    }

    private void initWebView() {
        webView = (WebView) findViewById( R.id.likeWebView );
        final WebSettings webSettings = webView.getSettings(); 
        webSettings.setJavaScriptCanopenWindowsAutomatically(true);
        webSettings.setJavaScriptEnabled(true);
        webSettings.setBuiltInZoomControls(false);
        webView.setScrollBarStyle(WebView.SCROLLBARS_OUTSIDE_OVERLAY);
        webView.setHorizontalScrollBarEnabled(false);
        webView.setWebChromeClient(new WallWebChromeClient());
    }

    private String getFacebookWallUrl() {

        Log.d(TAG, "facebook.getAccesstoken() != null");
        String wallUrl = "http://www.facebook.com/plugins/login.PHP?" + "href="
                + URLEncoder.encode("http://www.facebook.com/MyAppPage") + "&access_token="
                + URLEncoder.encode(facebook.getAccesstoken());

        Log.d(TAG, "wallUrl " + wallUrl);
        return wallUrl;
    }


    @Override
    public void onActivityResult(int requestCode, int resultCode, Intent data) {
        super.onActivityResult(requestCode, resultCode, data);
        Log.d(TAG, "onActivityResult");
        facebook.authorizeCallback(requestCode, resultCode, data);
    }
}

现在,当我按下按钮时,我转到一个新的活动,说我已经被授权,这意味着SSO可以正常工作.问题是,当我按“确定”按钮时,正如我所说,我想移至我的应用程序页面,但是我尝试的所有操作都向我显示了我的Facebook应用程序页面,但要求我再次登录.从我的角度来看,我需要在getFacebookWallUrl()方法上更改wallUrl字符串的开头,但找不到任何有关它的信息.

可能吗？

解决方法:

您是否正在通过社交网络分享有关您的应用程序的信息？如果您的答案是肯定的,请尝试this.

angularjs – PassportJs.如何在没有重定向用户的情况下获得facebook重定向uri后调用passport.authenticate(‘facebook’)

angularjs – PassportJs.如何在没有重定向用户的情况下获得facebook重定向uri后调用passport.authenticate(‘facebook’)

我有一个NodeJs REST服务让我们称它为 – 我后端的NodeRest和前端的AngularJs.

NodeRest假设用于移动应用程序以及Web应用程序,在我的情况下它是AngularJs应用程序.

使用PassportJs时,NodeRest的体系结构应解决以下问题：

服务器不应该将用户重定向到Facebook以进行授权

app.get('/auth/facebook',passport.authenticate('facebook'));

被称为.

如果它要重定向它,客户端将不会得到任何东西,因为回调URL链接到NodeRest httpL // noderest / facebook / callback.相反它应该提供重定向uri,所以我可以将它发送回客户端(angularJs,mobile等…).像这样的Smth：

app.get('/auth/facebook',passport.authenticate('facebook',function(redirectUri){ 
//emit socket event to the client with redirect uri as a response data. }));

我决定在授权过程中使用socket.io作为通信通道.

客户：

var socket = io.connect(baseUrl);
    socket.on('auth:facebook:callback:getCalled',function (data) {
      // callback get called on server side.
      // user has been authenicated.
      // so Now,user can talk with our NodeRest server to get and post data.      
      var firstName = data.firstName;
      var lastName = data.lastName;
});

$http.get(baseUrl + '/login/facebook').success(function(data,status,headers,config){
      redirectUriToAuthenticate = data;      
      $location.path(data);
});

客户将负责重定向到facebook / twitter等,以获得用户授权.之后,用户将被重定向到回调网址.

服务器：

app.get('/auth/facebook/callback',function(){
  passport.authenticate('facebook',{ successRedirect: '/',failureRedirect: '/login' })
  //socket.io emit event to the client with user data.
  io.sockets.on('connection',function (socket) {
  socket.emit('auth:facebook:callback:getCalled',{ data: User });
});

所有这些东西背后的一般想法是从不同类型的客户端应用程序(移动,Web,桌面等)获得授权.客户端必须只能将uri重定向到oauth2提供商(facebook,twitter等)并自行重定向到该uri. NodeRest将关注进一步的步骤(即处理回调和通知客户端).

我不知道这是一个很好的解决方案,我正在努力,所以任何类型的反馈都将是非常有用的.任何反馈我都会感激不尽.

先感谢您,
朱利安

解决方法

护照在这个问题上的记录很少 – 我也在很长一段时间内与它斗争.我发现你可以调用passport.authenticate(type,fn)(req,res,next),在fn中,你可以区分可以登录的用户和不能登录的用户.你可以打电话给req.logIn.

仅供参考,我假设您正在使用会话：

module.exports.createSession = function(req,next) {
  passport.authenticate('local',function(err,user,info) {
    if (err) {
      res.json(500,{ok: false});
    } else if(!user) {
      // you would probably want to do more work here
      // for example distinguishing between bad login credentials,// canceling,users not ready to log in (pending),etc.
      res.json(401,{ok: false});
    } else {
      req.logIn(user,function(err) {
        if (err) {
          res.json(500,{ok: false});
        } else {
          res.json(200,{
            ok:req.isAuthenticated(),username: req.user.username,email: req.user.email
          });
        }
      });
    }
  })(req,next);
};

这是为本地身份验证设置的,但我相信它应该与facebook auth一起使用而不做任何更改.

我们今天的关于Passport.js：password-facebook-token策略，通过JS SDK登录，然后对护照进行身份验证？的分享就到这里，谢谢您的阅读，如果想了解更多关于#import "facebookSDK/FacebookSDK.h file not found"、AccessToken-->Password Grant、android-通过“单一登录”进行身份验证后,移至Facebook应用程序页面、angularjs – PassportJs.如何在没有重定向用户的情况下获得facebook重定向uri后调用passport.authenticate(‘facebook’)的相关信息，可以在本站进行搜索。

本文标签：

上一篇如何用gulp-uglify缩小ES6功能？

下一篇CSS文件被阻止：MIME类型不匹配（X-Content-Type-Options：nosniff）（css因mime类型不匹配而忽略）

相关文章