انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-039

أساسيات OAuth 2.0 وOIDC

  • 8 درس
  • 2.5 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • الأدوار
  • التدفقات (Flows)
  • خادم التفويض (Authorization server)
  • خادم الموارد (Resource server)
  • تسجيل الدخول مقابل تفويض الـ API

تعلّم أولًا

2.5 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Name the OAuth 2.0 roles (resource owner, client, authorization server, resource server).
  2. Explain the authorization code flow with PKCE and the client credentials flow, and when each applies.
  3. Distinguish OAuth 2.0 (delegated API access) from OIDC (login, ID tokens).
  4. Configure the Shop API as a resource server trusting an external authorization server.

الدروس

  1. 01المشكلة التي يحلّها OAuth
  2. 02الأدوار والرموز
  3. 03رمز التفويض + PKCE
  4. 04بيانات اعتماد العميل (Client credentials)
  5. 05OIDC: إضافة تسجيل الدخول
  6. 06Spring كخادم موارد (Resource server)
  7. 07عرض عملي: إعداد Keycloak وتدفق رمز التفويض + PKCE
  8. 08عرض عملي: تحويل Shop إلى رموز صادرة من Keycloak

المختبر والتمارين

Lab

JNR-039-LAB1 · External identity

Outcomes: 1–4 · Time: ~2.5 h Run Keycloak locally, obtain tokens with Postman, and switch the Shop API to validate Keycloak-issued tokens, mapping realm roles to authorities. Acceptance: self-issued tokens from JNR-038 are no longer accepted.

Exercises (assessment: flow-selection scenarios)

IDOutcomeTask
JNR-039-EX011Name the four OAuth roles in this setup: a user, the Shop web app, Keycloak, the Shop API.
JNR-039-EX022Choose the flow: (a) a single-page app where users log in; (b) a nightly job calling an internal API; (c) a mobile app.
JNR-039-EX032Explain in your own words what PKCE protects against.
JNR-039-EX043Fill in a table of access token vs ID token: purpose, audience, sent to the API or not.
JNR-039-EX053A team sends the ID token to the API as a bearer token. Explain the problem.
JNR-039-EX064Write the YAML and converter to map realm_access.roles to ROLE_* authorities.
JNR-039-EX072Say why the implicit and password grants should not be used in new systems.
أظهر الحلول
  • EX01 User: resource owner; Shop web app: client; Keycloak: authorization server; Shop API: resource server.
  • EX02 (a) authorization code + PKCE; (b) client credentials; (c) authorization code + PKCE.
  • EX03 A stolen authorization code cannot be exchanged for tokens without the original code_verifier.
  • EX04 Access token: authorizes API calls, audience is the API, sent to the API. ID token: tells the client who logged in, audience is the client, never sent to the API.
  • EX05 The ID token is meant for the client; its audience is wrong for the API, and it is not designed to authorize access.
  • EX06 Set issuer-uri; in a JwtAuthenticationConverter read the realm_access claim's roles list and map each to new SimpleGrantedAuthority("ROLE_" + role.toUpperCase()).
  • EX07 Implicit exposes tokens in the browser URL; password grant makes the client handle user passwords. Both are discouraged by current best-practice guidance (verify before recording).

الاختبار

Outcomes: O1 roles · O2 flows and PKCE · O3 OAuth vs OIDC · O4 resource server configuration.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1The server that logs the user in and issues tokens is the:O1
  2. 2In our setup the Shop API is the:O1
  3. 3For a user logging in to a single-page app, use:O2
  4. 4For a back-end job with no user, use:O2
  5. 5PKCE protects against:O2
  6. 6OIDC adds to OAuth 2.0:O3
  7. 7The ID token should be sent to:O3
  8. 8OAuth 2.0 by itself is mainly about:O3
  9. 9issuer-uri lets Spring:O4
  10. 10Mapping realm roles to authorities is done with:O4

الجزء العملي

Seven exercises JNR-039-EX01 to EX07 plus the lab; the flow-selection scenarios (EX02, EX07) are the assessment. Pass: at least six exercises correct, correct flow chosen in every scenario, and old self-issued tokens rejected.

أخطاء شائعة

The implicit or password grant in new systems; using ID tokens to call APIs.

التقييم

Flow-selection scenarios.

الصلة بالمسار الوظيفي

Advanced API security (MID-051) and identity federation (ARC-027).

اكتب للبحث في المستويات والمراحل والوحدات والدروس.