Spring Social을 제대로 이해하기 위한 레퍼런스


1. OAuth 개념이해


OAuth 1/2, Access/Refresh Token, OAuth스펙 논란에 대한 좋은 내용들 (한글)  
http://earlybird.kr/1584



Access/Refresh Token
http://stackoverflow.com/questions/3487991/why-does-oauth-v2-have-both-access-and-refresh-tokens


Facebook 인증 그림

http://tungwaiyip.info/blog/2011/02/19/facebook_oauth_authentication_flow



2. OAuth 1,2 적용

OAuth 1을 적용한 twitter, OAuth 2를 적용한 facebook코드의 흐름은 Spring Social 을 쉽게 이해할 수 있게 함


* oauth1 :twitter, linkedin, tripit
* oauth2 : github, Facebook

http://static.springsource.org/spring-social/docs/1.0.x/reference/html/connecting.html
            <bean class="org.springframework.social.twitter.connect.TwitterConnectionFactory"]]]]>
                <constructor-arg value="${twitter.consumerKey}" />
                <constructor-arg value="${twitter.consumerSecret}" />                                
            </bean>
            <bean class="org.springframework.social.facebook.connect.FacebookConnectionFactory"]]]]>
                <constructor-arg value="${facebook.clientId}" />  // appid
                <constructor-arg value="${facebook.clientSecret}" />         
    </bean>                 
        



3. Facebook, Twitter 레퍼런스


* Facebook


Facebook은 app id 와 app secret을 이용해서 Facebook의 access token과 expire time을 얻어옴

https://developers.facebook.com/docs/facebook-login/login-flow-for-web-no-jssdk/


access token정보

http://developers.facebook.com/docs/facebook-login/access-tokens/


Graph API Explorer - access token으로 정보 얻어오는 web tool

https://developers.facebook.com/tools/explorer/


refresh token 비슷한 것을 사용하기로 함

https://developers.facebook.com/roadmap/offline-access-removal/


Graph API Explorer - accessToken으로 debug 또는 validation check

https://developers.facebook.com/tools/debug/

https://graph.facebook.com/debug_token?input_token=INPUT_TOKEN&access_token=ACCESS_TOKEN


How-To: Handle expired access tokens

http://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/


Login Security

https://developers.facebook.com/docs/facebook-login/security/



* Twitter


consumerKey, consumerSecret 정보 


access token에 대한 expire time이 존재하지 않는다. 
https://dev.twitter.com/docs/auth/oauth/faq

oauth 태그 저장된 정보

https://dev.twitter.com/tags/oauth



4. Spring Social  테이블 


spring social 의 jdbcUsersConnectionRepository.sql

createtable UserConnection (

userId varchar(255) notnull, // 사용자 아이디
providerId varchar(255) notnull, // facebook, twitter
providerUserId varchar(255),  // provier에서 자체적인 정의한 user id
rank intnotnull,   // rank는 내부적인 sequence로 보면 됨
displayName varchar(255),
profileUrl varchar(512),
imageUrl varchar(512),
accessToken varchar(255) not null secret varchar(255), refreshToken varchar(255), expireTime bigint, primarykey (userId, providerId, providerUserId));

createuniqueindex UserConnectionRank on UserConnection(userId, providerId, rank);


인증시시 key와 secret이 필요하다. 그리고, 실제 작업은 token과 secret만 있으면 된다. 

- Be a registered Twitter application => have consumer { key, secret } pair
- Be able to post tweets / images on behalf of the user => have access { token, secret } pair

** 참고1
만약 Connect 인증시스템을 개발한다면, 위 sql쿼리와 함께 UserConnection에 key값도 저장할 필요가 있다.


** 참고2

현재 2013.7월 현재 Refresh token not supported for OAuth2(https://jira.springsource.org/browse/SOCIAL-263) 에 따르면, spring social에 계속 넣을지 고민중이다. 



5. Spring Social 정보


홈피
http://www.springsource.org/spring-social


spring social 모듈
http://blog.springsource.org/2011/03/02/introducing-spring-socials-service-provider-framework/

  • spring-social-core – The service provider framework, OAuth support, and core classes.
  • spring-social-web – The connect controller and supporting types.
  • spring-social-facebook – A service provider implementation for connecting with Facebook and support for signing into an application via Facebook.
  • spring-social-twitter – A service provider implementation for connecting with Twitter and support for signing into an application via Twitter.
  • spring-social-linkedin – A service provider implementation for connecting with LinkedIn.
  • spring-social-tripit – A service provider implementation for connecting with TripIt.
  • spring-social-github – A service provider implementation for connecting with GitHub.
  • spring-social-gowalla – A service provider implementation for connecting with Gowalla.
  • spring-social-test – Support for testing service provider implementations and API bindings.


google plus
https://github.com/GabiAxel/spring-social-google


spring social source

https://github.com/SpringSource/spring-social


spring social samples

https://github.com/SpringSource/spring-social-samples


spring social twitter source

https://github.com/SpringSource/spring-social-twitter


spring social Facebook source

https://github.com/SpringSource/spring-social-facebook












Posted by 김용환 '김용환'

댓글을 달아 주세요