OAuth 2.0 概述

QOAuth2AuthorizationCodeFlow m_oauth;
QOAuthUriSchemeReplyHandler m_handler;

m_oauth.setAuthorizationUrl(QUrl(authorizationUrl));
m_oauth.setTokenUrl(QUrl(accessTokenUrl));
m_oauth.setClientIdentifier(clientIdentifier);
m_oauth.setRequestedScopeTokens({scope});

connect(&m_oauth, &QAbstractOAuth::authorizeWithBrowser, this, &QDesktopServices::openUrl);
connect(&m_oauth, &QAbstractOAuth::granted, this, [this]() {
    // Here we use QNetworkRequestFactory to store the access token
    m_api.setBearerToken(m_oauth.token().toLatin1());
    m_handler.close();
});

m_handler.setRedirectUrl(QUrl{"com.example.myqtapp://oauth2redirect"_L1});
m_oauth.setReplyHandler(&m_handler);

// Initiate the authorization
if (m_handler.listen()) {
    m_oauth.grant();
}

m_deviceFlow.setAuthorizationUrl(QUrl(authorizationUrl)); m_deviceFlow.setTokenUrl(QUrl(accessTokenUrl)); m_deviceFlow.setRequestedScopeTokens({scope}); m_deviceFlow.setClientIdentifier(clientIdentifier);// 是否需要客户端机密取决于授权服务器m_deviceFlow.setClientIdentifierScopeTokens({scope}); m_deviceFlow.setClientIdentifier(clientIdentifier);// 是否需要客户端机密取决于授权服务器setClientIdentifierSharedKey(clientSecret); connect( &m_deviceFlow, &QOAuth2DeviceAuthorizationFlow::authorizeWithUserCode, this,[](constQUrl用户代码 QString用户代码, constQUrl&completeVerificationUrl) {if(completeVerificationUrl.isValid()) {// 如果授权服务器提供了一个完整的 URL // 该 URL 已经包含了作为 URL 参数一部分的必要数据，则 // 您可以选择使用该  URL。            qDebug() << "Complete verification uri:" << completeVerificationUrl;
        }else{// 授权服务器只提供了验证 URL；使用该 URL            qDebug() << "Verification uri and usercode:" << verificationUrl << userCode;
        } ); connect(&m_deviceFlow, &m_deviceFlow.token() { // 这里我们使用 QNetworkRequestFactory来存储访问令牌。QAbstractOAuth::granted, this, [this](){// 这里我们使用 QNetworkRequestFactory 来存储访问令牌m_api.setBearerToken(m_deviceFlow.token().toLatin1()); }); m_deviceFlow.grant();

m_oauth.setRequestedScopeTokens({"openid"});

// This is for illustrative purposes, 'Automatic' is the default mode
m_oauth.setNonceMode(QAbstractOAuth2::NonceMode::Automatic);

connect(&m_oauth, &QAbstractOAuth2::idTokenChanged, this, [this](const QString &token) {
    Q_UNUSED(token); // Handle token
});

find_package(OpenSSL 1.0.0 QUIET)
set(JWT_CPP_INCLUDE_DIR "${CMAKE_SOURCE_DIR}/include")
if(OPENSSL_FOUND AND EXISTS "${JWT_CPP_INCLUDE_DIR}/jwt-cpp/jwt.h")

    target_include_directories(networkauth_oauth_snippets PRIVATE "${JWT_CPP_INCLUDE_DIR}")
    target_link_libraries(networkauth_oauth_snippets PRIVATE OpenSSL::SSL OpenSSL::Crypto)
    target_compile_definitions(networkauth_oauth_snippets PRIVATE JWT_CPP_AVAILABLE)

#ifdef JWT_CPP_AVAILABLE
#include "jwt-cpp/jwt.h"
#endif

try {
    const auto jwt = jwt::decode(m_oauth.idToken().toStdString());
    const auto jwks = jwt::parse_jwks(m_jwks->toJson(QJsonDocument::Compact).toStdString());
    const auto jwk = jwks.get_jwk(jwt.get_key_id());

   // 这里我们使用模数和指数来推导密钥 const auton=jwk.get_jwk_claim("n").as_string();// 模数 const autoe=jwk.get_jwk_claim("e").as_string();// 指数 if(n.empty()||e.empty()) {        qWarning() << "Modulus or exponent empty";
       return false; }if(jwt.get_algorithm()!= "RS256") {// 本示例仅支持 RS256        qWarning() << "Unsupported algorithm:" << jwt.get_algorithm();
       return false; }if(jwk.get_jwk_claim("kty").as_string()!= "RSA") {        qWarning() << "Unsupported key type:" << jwk.get_jwk_claim("kty").as_string();
       return false; }if(jwk.has_jwk_claim("use")&&jwk.get_jwk_claim("use").as_string()!= "sig") {        qWarning() << "Key not for signature" << jwk.get_jwk_claim("use").as_string();
       return false; }// Simple minimal verification (omits special cases and eg. 'sub' verification) . // jwt-cpp does check also 'exp', 'iat', and 'nbf' if they are present. const autokeyPEM=jwt::helper::create_public_key_from_rsa_components(n,e);autoverifier=jwt::verify().allow_algorithm(jwt::algorithm::rs256(keyPEM)) .with_claim("nonce",jwt::claim(m_oauth.nonce().toStdString()) .with_issuer(m_oidcConfig->value("issuer"_L1).toString().toStdString()) .with_audience(std::string(clientIdentifier.data()) .leeway(60UL); verifier.verify(jwt)；    qDebug() << "ID Token verified successfully";
   return true; }catch(conststd::exception&e) {// 处理错误。或者将错误参数传递给 jwt-cpp 调用    qWarning() << "ID Token verification failed" << e.what();
   return false; }

struct IDToken {
    QJsonObject header;
    QJsonObject payload;
    QByteArray signature;
};

std::optional<IDToken> parseIDToken(const QString &token) const;

if (token.isEmpty())
    return std::nullopt;

QList<QByteArray> parts = token.toLatin1().split('.');
if (parts.size() != 3)
    return std::nullopt;

QJsonParseError parsing;

QJsonDocument header = QJsonDocument::fromJson(
    QByteArray::fromBase64(parts.at(0), QByteArray::Base64UrlEncoding), &parsing);
if (parsing.error != QJsonParseError::NoError || !header.isObject())
    return std::nullopt;

QJsonDocument payload = QJsonDocument::fromJson(
    QByteArray::fromBase64(parts.at(1), QByteArray::Base64UrlEncoding), &parsing);
if (parsing.error != QJsonParseError::NoError || !payload.isObject())
    return std::nullopt;

QByteArray signature = QByteArray::fromBase64(parts.at(2), QByteArray::Base64UrlEncoding);

return IDToken{header.object(), payload.object(), signature};

m_network->get(request, this, [this](QRestReply &reply) {
    if (reply.isSuccess()) {
        if (auto doc = reply.readJson(); doc && doc->isObject())
            m_oidcConfig = doc->object(); // Store the configuration
    }
});

m_network->get(request, this, [this](QRestReply &reply) {
    if (reply.isSuccess()) {
        if (auto doc = reply.readJson(); doc && doc->isObject())
            m_jwks = doc; // Use the keys later to verify tokens
    }
});

QNetworkRequestFactory userInfoApi(url);
userInfoApi.setBearerToken(m_oauth.token().toLatin1());

m_network->get(userInfoApi.createRequest(), this, [this](QRestReply用户信息）{if(reply.isSuccess()) {if(autodoc=reply.readJson(); doc&&  doc->isObject())            qDebug() << doc->object(); // Use the userinfo
    });