OAuth-Spring Social 공부

Spring Social을 제대로 이해하기 위한 레퍼런스

1. OAuth 개념이해

OAuth 1/2, Access/Refresh Token, OAuth스펙 논란에 대한 좋은 내용들 (한글)  

http://earlybird.kr/1584

Access/Refresh Token

http://stackoverflow.com/questions/3487991/why-does-oauth-v2-have-both-access-and-refresh-tokens

Facebook 인증 그림

http://tungwaiyip.info/blog/2011/02/19/facebook_oauth_authentication_flow

2. OAuth 1,2 적용

OAuth 1을 적용한 twitter, OAuth 2를 적용한 facebook코드의 흐름은 Spring Social 을 쉽게 이해할 수 있게 함

* oauth1 :twitter, linkedin, tripit

* oauth2 : github, Facebook

http://static.springsource.org/spring-social/docs/1.0.x/reference/html/connecting.html

            <bean class="org.springframework.social.twitter.connect.TwitterConnectionFactory"]]]]>
                <constructor-arg value="${twitter.consumerKey}" />
                <constructor-arg value="${twitter.consumerSecret}" />                                
            </bean>
            <bean class="org.springframework.social.facebook.connect.FacebookConnectionFactory"]]]]>
                <constructor-arg value="${facebook.clientId}" />  // appid
                <constructor-arg value="${facebook.clientSecret}" />         

    </bean>                 

        

3. Facebook, Twitter 레퍼런스

* Facebook

Facebook은 app id 와 app secret을 이용해서 Facebook의 access token과 expire time을 얻어옴

https://developers.facebook.com/docs/facebook-login/login-flow-for-web-no-jssdk/

access token정보

http://developers.facebook.com/docs/facebook-login/access-tokens/

Graph API Explorer - access token으로 정보 얻어오는 web tool

https://developers.facebook.com/tools/explorer/

refresh token 비슷한 것을 사용하기로 함

https://developers.facebook.com/roadmap/offline-access-removal/

Graph API Explorer - accessToken으로 debug 또는 validation check

https://developers.facebook.com/tools/debug/

https://graph.facebook.com/debug_token?input_token=INPUT_TOKEN&access_token=ACCESS_TOKEN

How-To: Handle expired access tokens

http://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/

Login Security

https://developers.facebook.com/docs/facebook-login/security/

* Twitter

consumerKey, consumerSecret 정보 

https://dev.twitter.com/docs/auth

access token에 대한 expire time이 존재하지 않는다. 

https://dev.twitter.com/docs/auth/oauth/faq

oauth 태그 저장된 정보

https://dev.twitter.com/tags/oauth

4. Spring Social  테이블 

spring social 의 jdbcUsersConnectionRepository.sql

createtable UserConnection (

userId varchar(255) notnull, // 사용자 아이디
providerId varchar(255) notnull, // facebook, twitter
providerUserId varchar(255),  // provier에서 자체적인 정의한 user id
rank intnotnull,   // rank는 내부적인 sequence로 보면 됨
displayName varchar(255),
profileUrl varchar(512),
imageUrl varchar(512),
accessToken varchar(255) not null,  secret varchar(255), refreshToken varchar(255), expireTime bigint, primarykey (userId, providerId, providerUserId));

createuniqueindex UserConnectionRank on UserConnection(userId, providerId, rank);

인증시시 key와 secret이 필요하다. 그리고, 실제 작업은 token과 secret만 있으면 된다. 

http://stackoverflow.com/questions/7968641/spring-social-twitter-oauth

- Be a registered Twitter application => have consumer { key, secret } pair

- Be able to post tweets / images on behalf of the user => have access { token, secret } pair

** 참고1

만약 Connect 인증시스템을 개발한다면, 위 sql쿼리와 함께 UserConnection에 key값도 저장할 필요가 있다.

** 참고2

현재 2013.7월 현재 Refresh token not supported for OAuth2(https://jira.springsource.org/browse/SOCIAL-263) 에 따르면, spring social에 계속 넣을지 고민중이다. 

5. Spring Social 정보

홈피

http://www.springsource.org/spring-social

spring social 모듈

http://blog.springsource.org/2011/03/02/introducing-spring-socials-service-provider-framework/

• spring-social-core – The service provider framework, OAuth support, and core classes.
• spring-social-web – The connect controller and supporting types.
• spring-social-facebook – A service provider implementation for connecting with Facebook and support for signing into an application via Facebook.
• spring-social-twitter – A service provider implementation for connecting with Twitter and support for signing into an application via Twitter.
• spring-social-linkedin – A service provider implementation for connecting with LinkedIn.
• spring-social-tripit – A service provider implementation for connecting with TripIt.
• spring-social-github – A service provider implementation for connecting with GitHub.
• spring-social-gowalla – A service provider implementation for connecting with Gowalla.
• spring-social-test – Support for testing service provider implementations and API bindings.

google plus

https://github.com/GabiAxel/spring-social-google

spring social source

https://github.com/SpringSource/spring-social

spring social samples

https://github.com/SpringSource/spring-social-samples

spring social twitter source

https://github.com/SpringSource/spring-social-twitter

spring social Facebook source

https://github.com/SpringSource/spring-social-facebook