谁负责创建登录表单以获取accessToken?授权服务器还是Angular? [英] Who is responsible to create login form to get accessToken? Authorization server or Angular?

问题描述

我最近正在学习有关OAuth2的信息.基本上，我使用的是Angular客户端和后端Spring Boot Rest API.

I am recently learning about OAuth2. Basically I am using Angular client side, and Backend Spring Boot Rest API.

我对登录表单有些困惑.

I am having some little confusion regarding login form.

通常，当我们使用Facebook或Google Rest API等第三方REST Api时，这些API使用身份验证代码流，并且这些REST Apis为客户端提供登录表单，一旦用户授权，则只能访问资源.

Normally when we use 3rd party REST Api like Facebook or Google Rest API, these APIs use auth code flow, and these REST Apis provide client a login form, once user authorized, then only they can access resources.

在我的应用中，我没有使用任何第三方Rest api，而是在创建授权/资源服务器，并且正在使用身份验证代码流.因此，如果Angular客户端对后端资源服务器进行调用，授权服务器是否应显示登录表单? (就像FB或Google授权服务器一样)

In my app, I am not using any 3rd party Rest api, instead I am creating Authorization/Resource server and I am using auth code flow. so if a Angular client makes a rest call for Backend resource server, does login form should be displayed by Authorization server? (like FB or Google Authorization servers do)

Orelse客户端将使用angular创建一个登录页面，一旦他们登录，那么仅应执行身份验证代码流?

Orelse client will create a login page using angular, once they logged in, then only auth code flow should happen?

1. 简而言之，我的查询是:谁负责创建登录表单以获取accessToken?授权服务器还是Angular?

1. In short, my query is: Who is responsible to create login form to get accessToken? Authorization server or Angular?

如果我的资源服务器Rest API使用另一个第三方REST API(例如Facebook或google).所以我应该去认证代码流还是客户端凭证流?

If My Resource server Rest API using another 3rd party REST api (say Facebook or google). so should I go auth code flow or client credentials flow?

我已经看到了许多示例，它们是Spring Boot和Angular的组合，这些示例仅从Angular创建.登录表单.

I have seen many examples out there combination of Spring Boot and Angular, in those examples login form created from Angular only.

推荐答案

它应该是授权服务器的一部分，以将您路由到他们的登录表单，并在用户成功登录后，应返回到angular app带有 auth令牌(jwt令牌)，可用于授权api 调用.

It should be part of Authorization server to route you to their login form and on successful user login , should return back to angular app with auth token (jwt token) which you can use to authorize api calls.

这篇关于谁负责创建登录表单以获取accessToken?授权服务器还是Angular?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！