西维蜀黍

【Security】Authentication(身份认证)- OpenID Connect (OIDC)

OpenID Connect (OIDC)

OpenID Connect(简称 OIDC)是一个基于 OAuth 2.0 协议的身份认证层,它允许客户端应用程序验证用户的身份,并获取用户的基本信息(称为 profile 信息),这些信息通过一个称为 ID Token 的安全令牌提供。

OIDC 的核心作用

  • OAuth 2.0 解决了**授权(Authorization)**的问题:某个应用能否访问某些资源。
  • OpenID Connect 在其基础上解决了**身份认证(Authentication)**的问题:你是谁?

组成结构

+-------------+          +---------------+          +-----------------+
|  用户浏览器   | <------> |  客户端应用     | <------> | 身份提供方(OP) |
+-------------+          +---------------+          +-----------------+
                               ↑                            ↑
                               |---  ID Token, Access Token ----|
项目 说明
ID Token JWT 格式的身份令牌,包含用户身份信息(如 sub、email、name 等)
UserInfo Endpoint 一个标准化的 API 接口,客户端可以用 Access Token 请求更多用户资料
Discovery Endpoint 提供元信息,比如授权端点、token 端点、密钥等
Scopes 用于控制访问权限,常用的有 openid(必须)、profile、email 等
Claims 表示用户信息的字段,如 sub、name、email

示例 ID Token(JWT 结构):

  ...


【Security】Authorization(授权)- OAuth 2

Background

为了理解OAuth的适用场合,让我举一个假设的例子。

有一个"云冲印"的网站,可以将用户储存在Google的照片,冲印出来。用户为了使用该服务,必须让"云冲印"读取自己储存在Google上的照片。

  ...


【Security】Identity and Access Management (IAM) - Authentication(身份认证)和 Authorization(授权)

Identity and Access Management (IAM)

Identity and access management (IAM or IdAM for short) is a way to tell who a user is and what they are allowed to do. IAM is like the bouncer at the door of a nightclub with a list of who is allowed in, who isn’t allowed in, and who is able to access the VIP area. IAM is also called identity management (IdM).

  ...


【Security】Single Sign-On(SSO,单点登录)

Single Sign-On(SSO)

Single sign-on (SSO) is a service that enables users to authenticate only once. Users sign in to the SSO service, which then passes on this authentication to every application by sending a digital authentication message to each application as needed.

It should not be confused with same-sign on (Directory Server Authentication), often accomplished by using the Lightweight Directory Access Protocol (LDAP) and stored LDAP databases on (directory) servers.

  ...


【Engineering】Diagram

  ...


【Engineering】GraphQL

  ...


【Engineering】WebSocket

WebSocket

WebSocket is a computer communications protocol, providing a simultaneous two-way communication channel over a single Transmission Control Protocol (TCP) connection. The WebSocket protocol was standardized by the IETF as RFC 6455 in 2011. The current specification allowing web applications to use this protocol is known as WebSockets.

  ...


【Distributed System】Handle Conflicts - Version Vector/ 向量时钟(Vector Clock)

Version Vector/ 向量时钟(Vector Clock)

A version vector is a data structure used to track changes in distributed systems, particularly for conflict resolution in eventual consistency models.

🛠️ Used in:

  • Distributed databases (e.g., DynamoDB, Riak, CRDTs)
  • File synchronization (e.g., Dropbox, Git)
  • Conflict resolution in replicated systems
  • Event ordering & causality tracking
  ...


【Distributed System】Handle Conflicts - 时间戳(Lamport Timestamp)

The Lamport timestamp algorithm is a simple logical clock algorithm used to determine the order of events in a distributed computer system. As different nodes or processes will typically not be perfectly synchronized, this algorithm is used to provide a partial ordering of events with minimal overhead, and conceptually provide a starting point for the more advanced vector clock method. The algorithm is named after its creator, Leslie Lamport.

Distributed algorithms such as resource synchronization often depend on some method of ordering events to function. For example, consider a system with two processes and a disk. The processes send messages to each other, and also send messages to the disk requesting access. The disk grants access in the order the messages were received. For example process A sends a message to the disk requesting write access, and then sends a read instruction message to process B. Process B receives the message, and as a result sends its own read request message to the disk. If there is a timing delay causing the disk to receive both messages at the same time, it can determine which message happened-before the other: A happens-before B if one can get from A to B by a sequence of moves of two types: moving forward while remaining in the same process, and following a message from its sending to its reception. A logical clock algorithm provides a mechanism to determine facts about the order of such events. Note that if two events happen in different processes that do not exchange messages directly or indirectly via third-party processes, then we say that the two processes are concurrent, that is, nothing can be said about the ordering of the two events.[1]

Lamport invented a simple mechanism by which the happened-before ordering can be captured numerically. A Lamport logical clock is a numerical software counter value maintained in each process.

Conceptually, this logical clock can be thought of as a clock that only has meaning in relation to messages moving between processes. When a process receives a message, it re-synchronizes its logical clock with that sender. The above-mentioned vector clock is a generalization of the idea into the context of an arbitrary number of parallel, independent processes.

  ...


【Architectural Pattern】Overall

From Mud to Structure (High level decompositions)

  • Layers
  • Pipes and Filters
  • Blackboard

Distributed Systems

  • Broker

Interactive Systems

  • MVC (Model-view-controller)
  • Presentation-Abstraction-Control

Adaptable Systems

  • Microkernel
  • Reflection
  ...