跳到主要內容

OAuth Server

This is work in progress, will introduce more about how OAuth work in Blocklet Server Overview Blocklet Service can function as an OAuth server, suppo

Note

This is work in progress, will introduce more about how OAuth work in Blocklet Server

Overview

Blocklet Service can function as an OAuth server, supporting the standard OAuth 2.0 authorization code grant. It provides unified authentication and authorization services for third-party applications (such as Grafana). The process is similar to that of GitHub or Google's OAuth and is compatible with OpenID Connect.

Features:

  • OAuth 2.0 Authorization Code Grant Flow
  • Retrieving Basic User Information with OpenID Connect
  • Integrates with services supporting Generic OAuth, such as Grafana
  • Customizable Authorization Pages and Scope Management

 Authorization Overview

  • Users choose to log in via OAuth in third-party applications
  • The application redirects the user to the local OAuth Server for authentication and authorization.
  • After the user grants authorization, the OAuth Server redirects to the application with an authorization code.
  • The application uses the authorization code to obtain an access token
  • The application retrieves user information using the access token to complete login.

Authorization Process Details

User Authorization

Third-party applications will redirect users to the following URL:

javascript
GET https://your-oauth-server/oauth/authorize
    ?client_id=YOUR_CLIENT_ID
    &redirect_uri=YOUR_REDIRECT_URI
    &scope=openid%20profile%20email
    &state=RANDOM_STRING
    &response_type=code

Argument Description:

  • client_id: The application's client ID
  • redirect_uri: Callback URL; this must match the registered URL.
  • scope: The requested permissions
  • state: To prevent CSRF attacks, generate this value randomly.
  • response_type: Must be `code

User Consent

After the user logs in and grants authorization, the OAuth Server redirects to the redirect_uri, including the code and state parameters:

javascript
GET YOUR_REDIRECT_URI?code=AUTH_CODE&state=RANDOM_STRING

Token Exchange for Applications

Retrieve an access token using the authorization code:

javascript
POST https://your-oauth-server/oauth/token
Content-Type: application/x-www-form-urlencoded

client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&code=AUTH_CODE
&grant_type=authorization_code
&redirect_uri=YOUR_REDIRECT_URI

Returns:

javascript
{
  "access_token": "ACCESS_TOKEN",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "REFRESH_TOKEN",
  "scope": "openid profile email"
}

Retrieve User Information

Retrieve user information with an access token:

javascript
GET https://your-oauth-server/oauth/userinfo
Authorization: Bearer ACCESS_TOKEN
javascript
{
  "sub": "user_id",
  "name": "用户名",
  "email": "邮箱"
}