{"id":71307,"date":"2020-02-24T22:18:55","date_gmt":"2020-02-24T19:18:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt"},"modified":"2020-03-03T16:14:27","modified_gmt":"2020-03-03T13:14:27","slug":"identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt","title":{"rendered":"IdentityServer4. Konceptet kryesore. OpenID Connect, OAuth 2.0 dhe JWT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Me k\u00ebt\u00eb postim dua t\u00eb hap nj\u00eb seri artikujsh kushtuar IdentityServer4. Do t\u00eb fillojm\u00eb me konceptet baz\u00eb.<\/p>\n

<\/p>\n

Protokolli m\u00eb premtues i autentikimit n\u00eb k\u00ebt\u00eb moment \u00ebsht\u00eb OpenID Connect<\/a><\/noindex>, nd\u00ebrsa protokolli i autorizimit (dh\u00ebnies s\u00eb aksesit) \u00ebsht\u00eb OAuth 2.0<\/a><\/noindex>. IdentityServer4<\/a><\/noindex> zbaton k\u00ebto dy protokolle. Ai \u00ebsht\u00eb i optimizuar p\u00ebr zgjidhjen e problemeve tipike<\/strong> t\u00eb siguris\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

OpenID Connect<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb protokoll dhe standard autentikimi; ai nuk jep akses te burimet (Web API), por meq\u00eb \u00ebsht\u00eb nd\u00ebrtuar mbi protokollin e autorizimit OAuth 2.0<\/a><\/noindex>, ai ju lejon t\u00eb merrni parametrat e profilit t\u00eb p\u00ebrdoruesit sikur t\u00eb kishit marr\u00eb akses te burimi UserInfo<\/a><\/noindex>.<\/p>\n

JWT<\/a><\/noindex> (JSON Web Token) \u00ebsht\u00eb nj\u00eb standard web q\u00eb p\u00ebrcakton m\u00ebnyr\u00ebn e transmetimit t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesit n\u00eb format JSON n\u00eb form\u00eb t\u00eb enkriptuar.<\/p>\n

OAuth 2.0 (RFC 6749)<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb protokoll dhe standard autorizimi. Ai u lejon aplikacioneve t\u00eb marrin akses n\u00eb burime t\u00eb mbrojtura, p\u00ebr shembull te Web API.<\/p><\/blockquote>\n

Le t'i hedhim nj\u00eb sy diagramit t\u00eb qasjes n\u00eb nj\u00eb burim t\u00eb mbrojtur dhe t\u00eb shqyrtojm\u00eb hapat kryesor\u00eb si edhe terminologjin\u00eb e p\u00ebrdorur:<\/p>\n

<\/p>\n

\"IdentityServer4.<\/p>\n

<\/p>\n

    \n
  1. \n

    Klienti i k\u00ebrkon p\u00ebrdoruesit leje p\u00ebr t\u00eb kaluar autorizimin n\u00eb emrin e tij. K\u03bb\u03af\u03bf\u03c5ent<\/strong> \u2014 \u00ebsht\u00eb nj\u00eb aplikacion klient q\u00eb qaset n\u00eb burime t\u00eb mbrojtura n\u00eb em\u00ebr t\u00eb pronarit t\u00eb burimeve. Burimi<\/strong> \u2014 jan\u00eb t\u00eb gjitha sh\u00ebrbimet tona t\u00eb mbrojtura Web API<\/a><\/noindex>.<\/p>\n

    \n<\/li>\n

  2. \n

    User i lejon aplikacionit klient t\u00eb kaloj\u00eb autorizimin n\u00eb emrin e tij, p\u00ebr shembull duke futur login dhe fjal\u00ebkalimin. Login-i dhe fjal\u00ebkalimi do t\u00eb sh\u00ebrbejn\u00eb si grant autorizimi p\u00ebr aplikacionin klient. User (pronari i burimit)<\/strong> \u2014 \u00ebsht\u00eb nj\u00eb program ose nj\u00eb person q\u00eb mund t\u00eb jap\u00eb akses n\u00eb burime t\u00eb mbrojtura, p\u00ebr shembull duke futur login-in (username) dhe fjal\u00ebkalimin (password);<\/p>\n

    \n<\/li>\n

  3. \n

    Aplikacioni klient k\u00ebrkon token-in e aksesit nga IdentityServer4<\/code> duke dh\u00ebn\u00eb informacion p\u00ebr veten (client_id<\/code>, client_secret<\/code>), duke paraqitur lejen e autorizimit nga p\u00ebrdoruesi (username<\/code>, password<\/code>) dhe duke dh\u00ebn\u00eb grant_type<\/code> dhe scope<\/code>. M\u00eb pas serveri i autorizimit verifikon autenticitetin e klientit dhe kredencialet e pronarit t\u00eb burimit (login-in dhe fjal\u00ebkalimin). <\/p>\n

    <\/p>\n

    Protokolli OAuth 2.0 kryen autentikimin jo vet\u00ebm t\u00eb p\u00ebrdoruesit, por edhe t\u00eb aplikacionit klient q\u00eb po qaset n\u00eb burime. P\u00ebr k\u00ebt\u00eb, protokolli parashikon parametra t\u00eb till\u00eb si client_id<\/strong> dhe client_secret<\/strong>.
    \n\u0441lient_id<\/strong> \u2014 \u00ebsht\u00eb identifikuesi i aplikacionit klient, i p\u00ebrdorur IdentityServer4<\/code> p\u00ebr t\u00eb gjetur informacion rreth klientit.
    \nclient_secret<\/strong> \u00ebsht\u00eb analog i fjal\u00ebkalimit p\u00ebr aplikacionin klient dhe p\u00ebrdoret p\u00ebr autentikimin e aplikacionit klient n\u00eb IdentityServer4<\/code>. Sekreti i klientit duhet t\u00eb njihet vet\u00ebm nga aplikacioni dhe API<\/strong>. Nga sa u tha m\u00eb sip\u00ebr, arrijm\u00eb n\u00eb p\u00ebrfundimin se IdentityServer4 duhet t\u2019i njoh\u00eb klient\u00ebt e vet<\/strong>.<\/p><\/blockquote>\n

    \n<\/li>\n

  4. \n

    N\u00ebse autenticiteti i aplikacionit \u00ebsht\u00eb konfirmuar dhe leja e autorizimit \u00ebsht\u00eb e vlefshme, IdentiryServer4<\/code> krijon access-token<\/code> (token aksesi) p\u00ebr aplikacionin dhe nj\u00eb \u00e7el\u00ebs rifreskimi opsional (refresh-token<\/code>). Procesi i autorizimit ka p\u00ebrfunduar. N\u00ebse k\u00ebrkesa \u00ebsht\u00eb e pavlefshme ose e paautorizuar, at\u00ebher\u00eb serveri i autorizimit kthen nj\u00eb kod me mesazhin p\u00ebrkat\u00ebs t\u00eb gabimit.<\/p>\n

    \n<\/li>\n

  5. \n

    Aplikacioni klient k\u00ebrkon t\u00eb dh\u00ebna nga Web API i mbrojtur, duke paraqitur tokenin e aksesit p\u00ebr autorizim. N\u00ebse kodi i p\u00ebrgjigjes s\u00eb serverit t\u00eb burimeve \u00ebsht\u00eb 401<\/a><\/noindex>, 403<\/a><\/noindex> ose 498<\/a><\/noindex>, at\u00ebher\u00eb tokeni i aksesit i p\u00ebrdorur p\u00ebr autentikim \u00ebsht\u00eb i pavlefsh\u00ebm ose ka skaduar.<\/p>\n

    \n<\/li>\n

  6. \n

    N\u00ebse tokeni \u00ebsht\u00eb i vlefsh\u00ebm, Web API<\/code> i jep t\u00eb dh\u00ebnat aplikacionit.<\/p>\n

    \n<\/li>\n<\/ol>\n

    <\/p>\n

    Llojet e token\u00ebve<\/em><\/h4>\n

    <\/p>\n

    Klient\u00ebve t\u00eb regjistruar n\u00eb IdentityServer4<\/code> u lejohet t\u00eb k\u00ebrkojn\u00eb nga IdentityServer4<\/code> identity<\/code>-token, access<\/code>-token dhe refresh<\/code>-token.<\/p>\n

    <\/p>\n