{"id":71307,"date":"2020-02-24T22:18:55","date_gmt":"2020-02-24T19:18:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt"},"modified":"2020-03-03T16:14:27","modified_gmt":"2020-03-03T13:14:27","slug":"identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/identityserver4-osnovnye-ponyatiya-openid-connect-oauth-2-0-i-jwt","title":{"rendered":"IdentityServer4. Konceptet kryesore. OpenID Connect, OAuth 2.0 dhe JWT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Me k\u00ebt\u00eb post d\u00ebshiroj t\u00eb hap nj\u00eb seri artikujsh consacratuar IdentityServer4. T\u00eb fillojm\u00eb nga konceptet kryesore.<\/p>\n

<\/p>\n

Protokolli m\u00eb premtues n\u00eb k\u00ebt\u00eb moment p\u00ebr autentifikim \u00ebsht\u00eb OpenID Connect<\/a><\/noindex>, dhe protokolli p\u00ebr autorizim (dh\u00ebnie aksesit) \u00ebsht\u00eb OAuth 2.0<\/a><\/noindex>. IdentityServer4<\/a><\/noindex> implementon k\u00ebto dy protokolle. Ai \u00ebsht\u00eb optimizuar p\u00ebr t\u00eb zgjidhur problemet tipike<\/strong> t\u00eb siguris\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

OpenID Connect<\/a><\/noindex> \u2014 ky \u00ebsht\u00eb nj\u00eb protokoll dhe standard autentifikimi, ai nuk jep akses n\u00eb burime (Web API), por pasi \u00ebsht\u00eb zhvilluar mbi protokollin e autorizimit OAuth 2.0<\/a><\/noindex>, ai lejon marrjen e parametrave t\u00eb profilit t\u00eb p\u00ebrdoruesit si\u00e7 do t\u00eb kishit marr\u00eb akses n\u00eb burimin UserInfo<\/a><\/noindex>.<\/p>\n

JWT<\/a><\/noindex> (JSON Web Token) paraqet nj\u00eb standard web-i q\u00eb p\u00ebrcakton m\u00ebnyr\u00ebn e transferimit t\u00eb t\u00eb dh\u00ebnave mbi p\u00ebrdoruesin n\u00eb formatin JSON n\u00eb nj\u00eb form\u00eb t\u00eb enkriptuar.<\/p>\n

OAuth 2.0 (RFC 6749)<\/a><\/noindex> \u2014 ky \u00ebsht\u00eb nj\u00eb protokoll dhe standard autorizimi. Ai lejon aplikacioneve t\u00eb ken\u00eb akses n\u00eb burime t\u00eb mbrojtura, si p.sh. Web API.<\/p><\/blockquote>\n

Le t\u00eb shohim diagramin e k\u00ebrkes\u00ebs p\u00ebr burime t\u00eb mbrojtura dhe t\u00eb zb\u00ebrthejm\u00eb hapat kryesor\u00eb dhe terminologjin\u00eb e pranuar:<\/p>\n

<\/p>\n

\"IdentityServer4.<\/p>\n

<\/p>\n

    \n
  1. \n

    Klienti k\u00ebrkon nga p\u00ebrdoruesi leje p\u00ebr t\u00eb kaluar autorizimin n\u00eb emrin e tij. Klienti<\/strong> \u2014 \u00ebsht\u00eb nj\u00eb aplikacion klienti q\u00eb qasje n\u00eb burimet e mbrojtura n\u00eb em\u00ebr t\u00eb pronarit t\u00eb burimeve. Burimi<\/strong> \u2014 jan\u00eb t\u00eb gjitha sh\u00ebrbimet tona t\u00eb mbrojtura Web API<\/a><\/noindex>.<\/p>\n

    \n<\/li>\n

  2. \n

    P\u00ebrdoruesi lejon aplikacionin klient t\u00eb autorizohet n\u00eb emrin e tij, p\u00ebr shembull, duke futur emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin. Emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi do t\u00eb sh\u00ebrbejn\u00eb si grant autorizimi p\u00ebr aplikacionin klient. P\u00ebrdoruesi (pronari i burimit)<\/strong> \u2014 \u00ebsht\u00eb nj\u00eb program ose person q\u00eb mund t\u00eb jap\u00eb qasje n\u00eb burime t\u00eb mbrojtura, p\u00ebr shembull, duke futur emrin e p\u00ebrdoruesit (username) dhe fjal\u00ebkalimin (password);<\/p>\n

    \n<\/li>\n

  3. \n

    Aplikacioni klient k\u00ebrkon nj\u00eb token qasje nga IdentityServer4<\/code> duke ofruar informacion mbi veten (client_id<\/code>, client_secret<\/code>), duke ofruar lejen p\u00ebr autorizim nga p\u00ebrdoruesi (username<\/code>, password<\/code>) dhe duke ofruar grant_type<\/code> dhe scope<\/code>. Pastaj, serveri i autorizimit verifikon autencitetin e klientit dhe t\u00eb dh\u00ebnat e pronarit t\u00eb burimit (emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi). <\/p>\n

    <\/p>\n

    Protokolli OAuth 2.0 kryen autentikimin jo vet\u00ebm t\u00eb p\u00ebrdoruesit, por edhe t\u00eb aplikacionit klient q\u00eb po akseson burimet. P\u00ebr k\u00ebt\u00eb, protokolli parashikon parametra t\u00eb till\u00eb si client_id<\/strong> dhe client_secret<\/strong>.
    \nclient_id<\/strong> \u2014 \u00ebsht\u00eb identifikuesi i aplikacionit klient q\u00eb p\u00ebrdoret IdentityServer4<\/code> p\u00ebr t\u00eb k\u00ebrkuar informacionin mbi klientin.
    \nclient_secret<\/strong> \u00ebsht\u00eb nj\u00eb analog i fjal\u00ebkalimit p\u00ebr aplikacionin klient dhe p\u00ebrdoret p\u00ebr autentifikimin e aplikacionit klient n\u00eb IdentityServer4<\/code>. Sekreti i klientit duhet t\u00eb jet\u00eb i njohur vet\u00ebm p\u00ebr aplikacionin dhe API-n\u00eb<\/strong>. Duke u bazuar n\u00eb t\u00eb dh\u00ebnat e m\u00ebsip\u00ebrme, arrihet n\u00eb p\u00ebrfundimin se IdentityServer4 duhet t\u00eb dij\u00eb p\u00ebr klient\u00ebt e tij<\/strong>.<\/p><\/blockquote>\n

    \n<\/li>\n

  4. \n

    N\u00ebse autenticiteti i aplikacionit konfirmohet dhe leja p\u00ebr autorizim \u00ebsht\u00eb e vlefshme, IdentiryServer4<\/code> krijon token-in e aksesit<\/code> (token akses) p\u00ebr aplikacionin dhe nj\u00eb \u00e7el\u00ebs opsional rinovimi (token rinovimi<\/code>). Procesi i autorizimit \u00ebsht\u00eb p\u00ebrfunduar. N\u00ebse k\u00ebrkesa \u00ebsht\u00eb e pavlefshme ose e paautorizuar, serveri i autorizimit kthen nj\u00eb kod me mesazhin p\u00ebrkat\u00ebs t\u00eb gabimit.<\/p>\n

    \n<\/li>\n

  5. \n

    Aplikacioni klient i drejtohet API-s\u00eb s\u00eb sigurt Web p\u00ebr t\u00eb marr\u00eb t\u00eb dh\u00ebna, duke ofruar token-in e aksesit p\u00ebr autorizim. N\u00ebse kodi i p\u00ebrgjigjes nga serveri i burimeve 401<\/a><\/noindex>, 403<\/a><\/noindex> ose 498<\/a><\/noindex>, at\u00ebher\u00eb token-i i aksesit i p\u00ebrdorur p\u00ebr autentifikim \u00ebsht\u00eb i pavlefsh\u00ebm ose i skaduar.<\/p>\n

    \n<\/li>\n

  6. \n

    N\u00ebse token-i \u00ebsht\u00eb i vlefsh\u00ebm, Web API<\/code> ofron t\u00eb dh\u00ebnat p\u00ebr aplikacionin.<\/p>\n

    \n<\/li>\n<\/ol>\n

    <\/p>\n

    Llojet e tokeneve<\/em><\/h4>\n

    <\/p>\n

    T\u00eb regjistruarve n\u00eb IdentityServer4<\/code> klient\u00ebt u lejohet t\u00eb k\u00ebrkojn\u00eb IdentityServer4<\/code> token-in e identitetit<\/code>-token, access<\/code>-token dhe rinovim<\/code>-token.<\/p>\n

    <\/p>\n