我一直在研究OAuth,发现它大致执行以下操作:
- client sends request token during redirect to server
- Server displays authorization screen to resource owner
- Resource owner provides uid and pw (not passed to client)
- Server sends access token back to client
- clients then users the Access token to gain access to a
resource
根据我的阅读,似乎OAuth并不支持SSO或联合身份验证,但有些博客暗示它可以实现SSO。
这是正确的还是错误的?它能否在没有其他协议的帮助下执行SSO?
谢谢。