|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/oauth-2-nailed-the-core-framework-with-hands-dirty/
课程评论：没有评论
**课程名称：OAuth 2.0：掌握核心框架，实践出真知** **课程概述：** 本课程旨在通过一种生产级的授权服务器（如Keycloak）来深入学习OAuth 2.0。我们之所以选择从一个现成的、符合规范的授权服务器入手，是为了确保我们从一开始就走在正确的道路上，避免在理解核心概念时因实现不当而产生偏差。 通过这种方式，学员可以专注于理解客户端如何与授权服务器在各种不同流程（例如：授权码许可流程、隐式许可流程、客户端凭证流程、刷新令牌流程等）中进行交互。课程强调，在实际生产环境中，从零开始编写授权服务器的情况非常少见。 本课程的首要目标是理解OAuth 2.0的基础概念。我们将把复杂的OAuth 2.0概念分解成易于理解的小块，并逐步构建对整个框架的认知。通过将授权服务器这个复杂的组件“外包”给一个已经正确实现的软件，学员可以更轻松地掌握核心理论。一旦对相关理论有了透彻的理解，即便将来需要自行实现授权服务器，也将事半功倍。 在课程中，我们将开发OAuth 2.0客户端和受保护资源（一个提供API的简单服务），并使用OAuth 2.0框架来保护这些API。在深入理解了授权服务器的工作原理以及熟悉RFC 6749规范后，学员将有能力愉快地实现一个简单的授权服务器。 课程设计理念是避免一开始就让学员构建授权服务器，因为这可能会分散精力，让学员在处理OAuth的各种角色时感到困惑，并可能因为对概念的误解而花费更多时间纠正错误。因此，本课程精心设计，注重OAuth 2.0框架的扎实理解。 **核心优势：** * **从实践出发：** 使用生产级授权服务器，快速进入核心概念的学习。 * **聚焦核心：** 避免在早期阶段陷入授权服务器实现的复杂性，专注于客户端与授权服务器的交互。 * **循序渐进：** 将复杂的OAuth 2.0概念分解，由浅入深地进行讲解。 * **理论与实践结合：** 在掌握理论后，能够自信地开发客户端、受保护资源，乃至简单的授权服务器。 （更多信息，请参考作者的博客。）
In this course, we will start learning Oauth2 by using a production-ready Authorization Server such as Keycloak at the beginning. That sounds reasonable, but why do we do that?By using a correct implementation authorization server at the beginning, it prevents us from going in the wrong way by ensuring that the authorization server complies with the Oauth 2.0 specification correctly. Besides, we can peacefully focus on how a client communicates with the authorization server in various different flows that are available and waiting for us to learn them and understand them. At the end of the day, it is less likely that one will use the Authorization server written from scratch for their production. And more importantly, we are focusing on fundamentals as our first priority. We wanted to divide the huge concept apart and conquer each small enough pieces that can be easily comprehended from the ground up.Hence we offload what we haven't focused yet to another piece of software we believe it implements correctly. Once we understand ins and outs all relevant theories, then our implementation will hardly go wrong if we really wanted to implement an Authentication server ourselves, In addition, the Authorization server is unarguably a complex system. So again, we won't implement an authorization server in this course.After we develop the OAuth 2.0 client and protected-resource. The protected resource will be a simple service that exposes APIs. Then we protected them with the Oauth2 framework. And with all solid understanding of the fundamental of how an authorization server behaves, plus the familiarity with RFC6749. Then we can at least implement a simple authorization server with joy.Let's imagine that, if this course was designed completely opposite direction, that is to guide you to start building the Authorization server at the beginning, it will draw a lot of energy from us. It will keep us juggling all OAuth's roles at once, and possibly take time to correct any mistakes that may occur from misunderstanding the concept and hence it could possibly take longer to achieve that same goal. That is why this course is carefully designed to deeply understand the Oauth 2.0 framework.For more information and more specialty, please find my blog under my profile picture.
