Auth的原理网上有很多，我这里就不在赘述了。
这里有张时序图我个人觉得是比较合理而且直观的，（感谢这篇博文：http://justcoding.iteye.com/blog/1950270）
参照这个流程，模拟了下部分代码，当然是尽可能的以简单的形式去表达下自己的见解
模拟了配置文件去掉数据库处理的部分
config.php 定义了公司及对应的操作用户的权限
<?php
return array(
'app'=>array(
'a1'=>array(
'accesskey'=>'123456',//凭证
'type'=>0,//聚合这里规定type对应的请求权限
'appname'=>'gavinjun',
),
),
'type'=>array(
array(
'获取用户的信息','获取用户的金钱',
),
),
);
user_config.php 用户表的模拟
<?php
return array(
'admin'=>'123456',
);
<?php //权限2.0的主程
class Auto{
private $vession=2.0;
private $notic=null;
public function __construct(){
$notic = require 'config.php';
$this->notic = $notic;
}
//校验商户
public function check($_param=array()){
if(empty($_param)){
return false;
}
//获取传过来的accesskey appid
$appid = !empty($_param['appid'])?$_param['appid']:0;
$accesskey=!empty($_param['accesskey'])?$_param['accesskey']:'';
if(!$appid||!$accesskey)
return false;
//校验开始
$notic = $this->notic;
return $notic['app'][$appid]?$notic['app'][$appid]['accesskey']==$accesskey:false;
}
//用户发起登录请求
public function getLoginCallBack($_param){
if($this->check($_param)){
//校验通过返回临时的token 以下都是不安全的方式只是模拟auto的流程
//这里可以用加密 请求时间|请求完成后跳转地址|用户的md5(accesskey)
return time().'|'.$_param['redirect'].'|'.md5($_param['accesskey']).'|'.$_param['appid'];
}else{
echo '商户未注册';
return false;
}
} //用户输入完用户名和密码之后
public function inLogin($name,$pwd){
$user = require("user_config.php");
return $user[$name]?$user[$name]==$pwd:false;
}
//用户登录完成后带着token值来请求我们的令牌
public function getAceess($_param){
$token = $_param['access_token'];
if(!$token)
return false;
list($time,$redirect,$authkey,$appid) = explode('|',$token);
//请求$appid 获取他的accesskey
$notic = $this->notic;
$accesskey = $notic['app'][$appid]['accesskey'];
if(time()>$time+5*60){
//超过5分钟才请求默认失败
return false;
}
if(md5($accesskey)!=$authkey){
//链接不安全
return false;
}
//返回正式的key
//这个key可以保存在数据库中设置这个key的失效时间 //我这里随便固定了他的accesskey
//给跳转的页面发送一个key 用post的应该，不过模拟就算了
$access = 'success';
return $redirect.'?access='.$access;
} public function doSomeByaccess($access){
//和数据库中做比对 这里不写了，就全部默认成功
if($access){
$appid = 'a1';
}
$notic = $this->notic;
$type = $notic['app'][$appid]['type'];
foreach($notic['type'][$type] as $v){
echo '用户权限：'.$v.'<br>';
} }
}
这里是模拟下这段程序的流程
<?php
//模拟流程
require 'auth2.php';
$auth2= new Auto(); //step 1: 用户点击平台上的登录按钮
//该商户的信息 appid=a1，accesskey=123456
$step1=$auth2->getLoginCallBack(array('appid'=>'a1','accesskey'=>'123456','redirect'=>'http://www.baidu.com'));
//系统内部跳转到登录界面拿到临时token 让用户去登录授权
$access_token = $step1;
/**系统内部的处理流程***/
//系统跳到登录地址?access_token=$step1 用户输入用户名和密码
//模拟用户授权
if($auth2->inLogin('admin','123456')){
//用户同意登录返回了一个令牌$access_token是用户登录请求的时候带上的
$arr['access_token']=$access_token;
$url = $auth2->getAceess($arr);
//这个url会发送给平台，平台拿到这个 令牌可以去访问用户信息
echo $url;
}
/****系统内部处理结束跳转到用户平台地址，发送post信息****/
//假设平台接到这个信息他保存下来了这个accesskey，去读取一遍用户的信息
$url = parse_url($url);
list($access,$accesskey)=explode('=',$url['query']);
$auth2->doSomeByaccess($accesskey);
结果：
aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAekAAAA/CAIAAABLvKdGAAAI0UlEQVR4nO2ZwXLbOAyG/f5PsId2JufuOX0Hy76l3ZntLRWpyR7a2X2C7MGyTJHAT5CULCvzf+MmFAWAACT+UtyD94P3/u3tn69fn5+enj59+vxHLZ8/fXp6enp+fn57e/ODnzEM3vshmh2CqWH8d7H0N8vhYjP+uHmGLtFakf0wDNf1g3yGaTT3H4bh9+/fP/7+cTqduq47dsdjd+yOx2N3HJkG4+Hl5Hy2C6Ym566b+3fHW/h59C4czMLO7buuu64f5NNNo9h/inFkaSyNpe26tIN3zjvvvXv9+fPbt+8vLy/n03nidDqdzufpc778PJ3Pp/HU9dzpdD69vLx8//7X6+vrVQad9955565D5733blzQj+uOps65ycu54MwU7HZ8C+Cu44u9u4Zx3js3leYmbxfGc+5ieJ0eF3V+GIZfv3799+9/hBDymBzcRe+c/BsMponb2E8/fXp28vMzex/bjfIbznohigN46YClxf4sbUybpd1mWZoQSPB4gNIOvev73vWud865vneu73vnLofjr/F4Go+n+v5if/WYfMe58eToPFoGEftpSRcuOHr1s8Wuntclp4z6W2rXIgJ3lsbSWBpL+5ilHfrLCmPcEBdNzocz65nZNYXb7Lj+PNKY/NTG+RouNIw8r8dRwi60dOFvlsbSWBpL+2ClHb58+ZMffvjhh599fQ7vhBBC9ga1mxBC9ge1mxBC9ge1mxBC9ge1mxBC9ge1mxBC9ge1mxBC9ge1mxBC9ge1mxBC9ge1m5DH5XDI71CLzf0Js3qcDCv6WepSVGxLZx6lp4R8VA45LO7YoCINLTF7XTh+tuTGhjS6YwNwaIlp7GRLt98fX7u18hrLJuRuYC1o3+SpaohaBgZFyRg52F5FRTMsx6v2s6In2QxF+4qnThzHkspWbCvcdX2wPNUfob3VdwwppVRrwN6OtFg8pcUXB43yATi0aTfwXamfqaXmLuZjXAJ0o7T5D/1Wu1SRiyeAXbJem7fXeDORRajQGns0HDAdF8liKUa9jlxEubQnuWA/cbu05Yo11ybx+ThadLx2hVcpmwv3emttrpXU7nuC38gatRu/1t1Zu8VVtEmQbTbJlfrZqN1GOV5K2bbUbq22ZVdp4QNrN94ej4BxJzw+QFvTQ3EGu4OriZVxpQ6DinCxoplFPY2rZ7ONxlnl1fQdI7a9ovlIH8XbQlxJnJ/GoAtaupb5ML6Yg3Fea01kKSav9UGLFqUhlpNFXEXrf1q+ViaoC1dnzEfMKjufbYK9n1vlX3SYhkpJjd+Ti5gGT8epYzvhtbCUAOa13NbrpzivxRcH+GJpGeJ5DaQyWlD72qAFmbRsKiMOSudxGqJx6d2TzdyYT2kcS8nGuorG2XyM8xoVcTbMv/Ruse+U8MZOC8l2o2JHWPLBS2suOEMQbfF+2sel8Sd7jbI4WnT7IZiv0CZ7/PtoNz4Um27vQ6Nm2eMXrZjWZb/iaYSWOBrVfbDHWTB/sFfFHWvvRnRj4/lwUtwR4GawJyO6gAjhKTErLaX1+imOQVZR4TiZBdm9drf/tGcCLi3OXzMo7U9RZ/DAkqplFxXNv8MHXjSPd4I2KaaxSf7ZrLS1SreJaA/Cio6gFcZ8wjhp5Gyrs1dTm1+qn2LaYp6al33p7J1p4eG0uzR4+097MlrHS+8eY5xsPvb4xnvlDtq3oHtq/5j5r6c1wN4S1iKUdZmIkbU8J8k2Kv4m2m2Jb++55SGRz9aS3yLaLZ6teFJZ4leMwY2FfbOH0SSIKdpocaKY2lrAMl0FHBaNS59Vjc8wS3Vb5Z+9w6u3bnaJUlHLbgF7GsYr0ngdLVUU9fMwR7PRZixqll4avElRtqAA8TCc1HzTUMbbwt6vdL5xrGWonT0kpJOiSxQwdQf5pC5iPjgyrlqsC6xrzwf0B/cNdACsmxa4Sf7icvZDC2kmYmlaJrhFxiuipQSujuZV2p8F+xkVns0tsjxIRJbGOKZsLUbVlF51fFEJ2ReWLQr0omgVTROBIogujXstLArnU3QKGCzYT2yfVaeiZmaFPp9tkXVZ6KqECPkYWF5E2oXb7ri4TOOFWt7Wi84u3s+98MHLI4SQDwm1mxBC9sda2m35g+Ux/6h5zD+7KvpZ/b80RoPqP40JIe1kvmDCZELnbOzf00WLtn/ND+JnS25sSKM7NgCH2eClBtNMS/MJIXXUa4Flx9q1BmgZGBQlYyTKqsgMy/Gq/WzpyfRMwjbZ60IIuRtLarfxvVI7pcUXB1glW2jUbuC7Uj9TS819qXqL4hNC1mBh7bZHwwHTcZEslmLUr8hFlEt7kgv2E7cLRNMUOZs5xZqQbVny++4i7U4jbKjd4iraJMg2m+RK/azQbiy+6TMpTZLaTciGbPbejbUAK6NF+CoAFeFi7dptPxRnsgm866IcdS8ci82MitLSW/YSEEKMbPB9d2j8XiiCocuyYpEqES4BzGu5rddPcT4b3372PbkK4jUlhNyN+713p5aadoOFIgNNp0qp0Ls0KzFDEG3xftrH2dyiU/hBVZotIaSd+33fnVpqEURRE+UeC6UxnzBai3ZnHyRr91Mcg8dSezLZkgkhK7HBezfe8CCs6IiF0pJPGAcoMsgqWivrYjkEcXBkLSyOll1rqT4TQhZhm+9MgL0lrEUo6zIRI2t5TrJlVPxNtBvP4+eixZ3CTcgmmL4TEGey0pNfu+Q7k9Kl7bKS1ev0tdrybpt9GV+wn4c5mg2YN2o37hV1nJC78SjaLeqj9g4r6khWYYtSSqvLymLja3WjduM4IFpogM3C5pSuQghZlvq/r/FLpWntaxzLctGprBRWJ6OFyspfNrg22d5PbK89hyzYU6p7WBJC6igQKW0nV+9Yo+PiMo0XanlbLzq7eD83Z7+ZE7I7uNkIIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR/ULsJIWR//A+q4V861tMIqQAAAABJRU5ErkJggg==" alt="" />