基于OAuth2.0,OpenID Connect和UMA的用户认证授权系统架构  

System Architecture for User Authentication and Authorization Based of OAuth2.0, OpenID Connect and UMA

作　　者：沈桐 王勇 刘俊艳 SHEN Tong;WANG Yong;LIU Jun-yan(Beijing huitong jincai information technology co., LTD., Beijing 100053, China)

机构地区：[1]北京汇通金财信息科技有限公司,北京100053

出　　处：《软件》2017年第11期160-167,共8页Software

摘　　要：用户认证系统的基本功能是用来证明一个用户是他声称的那个用户,并管理该用户相关的基本信息。用户授权系统的基本功能是授予用户或应用权限访问受保护的资源。OAuth2.0是一个用户授权框架,该框架提供了使客户端应用可以请求用户授权该应用访问该用户受保护的资源的功能。Open ID Connect是基于OAuth2.0框架的用户身份认证协议。UMA是基于OAuth2.0框架的用户间授权协议。本文介绍了上述框架和协议的功能与实现,并整合三者尝试搭建完整的用户认证授权系统,使该系统架构具备功能上的完备性,良好的安全性,灵活的连通性,可扩展性,高性能以及高可用性。The basic function of a user authentication system is to prove a user is who he claims to be,and to manage the user’s basic information.The basic function of a user authorization system is to give user or application allowance to access protected resources.OAuth2.0is a user authorization framework that enables client application to ask users to delegate to them the ability to access the user’s protected resources.OpenID Connect is a user authentication protocol based on OAuth2.0framework.UMA is an authorization protocol based on OAuth2.0that enables user to user authorization.This paper gives a comprehensive overview of the functionality of the aforementioned frameworks and tries to build a complete user authentication and authorization system based on those frameworks.The finished system architecture is functionally complete,has good security,connectivity,extensibility,availability and high performance.

关 键 词：用户认证 用户授权 OAuth2.0 OpenID Connect UMA 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]