c# - 是否可以使用已知用户和密码执行身份验证？

Question

给定一个有效的用户名和密码，我可以使用OAuth、OAuth2或OpenId执行身份验证（基本上是为了知道用户和密码是否正常）吗？

我需要调用身份验证服务器以了解用户和密码是否有效。

更新

实际上我找到了一个文档，其中解释了 OAuth2 支持这种机制：

尽管如此，OAuth2 也支持用户告诉客户端他的用户​​名和密码的场景。在这种情况下，客户端将此信息以及客户端 ID 和客户端密码以及所需范围传输到授权服务器，然后直接获取所需令牌而无需再次调用。

那么，下一个问题是，请您提供一个可行的示例吗？

Answer 1

The OAuth 2.0 spec defines several different use cases or workflows targeted to different kinds of applications or authorization scenarios.

One of the authorization workflows, and the one most commonly associated with Oauth, is when a client application requests access to a protected resource but does not obtain the end user's credentials directly - the access request redirects to present the end user with a login screen owned by the authorization system, not owned by the client application. When the user presents credentials and agrees to allow the client app's request for access, then the authorization server returns an authorization code to the client app and the client app can use that code to obtain an access token to access the end user's protected resources.

That's called the authorization code grant, and it's detailed in section 4.1 of the OAuth2 spec.

There is another authorization workflow in which the client app does have possession of user credentials or some other form of shared secret. The client application includes the user credentials or shared secret when requesting an access token. This is called a client credentials grant, and is detailed in section 4.4 of the Oauth2 spec.

The client credentials grant may be closest to your scenario.