身份认证与授权深度解析：从零实现 Python 用户认证管理器与 OAuth 协

身份认证与授权深度解析从零实现 Python 用户认证管理器与 OAuth 协1. 技术分析1.1 身份认证概述身份认证是验证用户身份的过程认证方式 知识因素: 密码、PIN码 拥有因素: 令牌、手机 生物因素: 指纹、人脸 认证强度: 单因素认证 双因素认证 多因素认证1.2 授权机制授权类型 基于角色的访问控制(RBAC) 基于属性的访问控制(ABAC) 基于策略的访问控制(PBAC) 基于资源的访问控制(RBAC) 授权原则: 最小权限原则 职责分离 审计追踪1.3 SSO与OAuth单点登录协议 SAML: 安全断言标记语言 OAuth: 开放授权 OpenID Connect: 身份层 OAuth角色: 授权服务器 资源服务器 客户端 用户2. 核心功能实现2.1 用户认证管理器import hashlib import time import uuid class AuthenticationManager: def __init__(self): self.users {} self.sessions {} def register_user(self, username, password, email): if username in self.users: raise ValueError(Username already exists) salt uuid.uuid4().hex hashed_password self._hash_password(password, salt) self.users[username] { username: username, password_hash: hashed_password, salt: salt, email: email, created_at: time.time() } return True def _hash_password(self, password, salt): return hashlib.sha256((password salt).encode()).hexdigest() def authenticate(self, username, password): if username not in self.users: return False user self.users[username] expected_hash self._hash_password(password, user[salt]) if expected_hash ! user[password_hash]: return False session_id self._create_session(username) return session_id def _create_session(self, username): session_id str(uuid.uuid4()) self.sessions[session_id] { username: username, created_at: time.time(), last_access: time.time() } return session_id def validate_session(self, session_id): if session_id not in self.sessions: return None session self.sessions[session_id] if time.time() - session[last_access] 3600: del self.sessions[session_id] return None session[last_access] time.time() return session[username] def invalidate_session(self, session_id): if session_id in self.sessions: del self.sessions[session_id] return True return False2.2 角色权限管理器class RoleBasedAccessControl: def __init__(self): self.roles {} self.permissions {} def define_role(self, role_name): if role_name not in self.roles: self.roles[role_name] [] def define_permission(self, permission_name): if permission_name not in self.permissions: self.permissions[permission_name] [] def assign_permission_to_role(self, role_name, permission_name): if role_name in self.roles and permission_name in self.permissions: if permission_name not in self.roles[role_name]: self.roles[role_name].append(permission_name) def assign_role_to_user(self, username, role_name): if role_name not in self.roles: self.define_role(role_name) if username not in self.permissions: self.permissions[username] [] if role_name not in self.permissions[username]: self.permissions[username].append(role_name) def check_permission(self, username, permission_name): if username not in self.permissions: return False user_roles self.permissions[username] for role in user_roles: if role in self.roles and permission_name in self.roles[role]: return True return False def get_user_permissions(self, username): if username not in self.permissions: return [] permissions set() user_roles self.permissions[username] for role in user_roles: if role in self.roles: permissions.update(self.roles[role]) return list(permissions)2.3 OAuth客户端import requests class OAuthClient: def __init__(self, client_id, client_secret, auth_url, token_url): self.client_id client_id self.client_secret client_secret self.auth_url auth_url self.token_url token_url self.token None def get_authorization_url(self, redirect_uri, scopeopenid profile email): params { client_id: self.client_id, redirect_uri: redirect_uri, scope: scope, response_type: code } return f{self.auth_url}?{requests.compat.urlencode(params)} def exchange_code_for_token(self, code, redirect_uri): data { grant_type: authorization_code, code: code, redirect_uri: redirect_uri, client_id: self.client_id, client_secret: self.client_secret } response requests.post(self.token_url, datadata) if response.ok: self.token response.json() return self.token raise ValueError(fToken exchange failed: {response.text}) def get_user_info(self, user_info_url): if not self.token: raise ValueError(No access token available) headers { Authorization: fBearer {self.token[access_token]} } response requests.get(user_info_url, headersheaders) if response.ok: return response.json() raise ValueError(fFailed to get user info: {response.text})2.4 MFA管理器import pyotp import qrcode class MFAManager: def __init__(self): self.secrets {} def generate_secret(self, username): secret pyotp.random_base32() self.secrets[username] secret return secret def get_provisioning_uri(self, username, issuer_nameMyApp): secret self.secrets.get(username) if not secret: raise ValueError(User not found) return pyotp.totp.TOTP(secret).provisioning_uri(username, issuer_nameissuer_name) def generate_qr_code(self, username, issuer_nameMyApp): uri self.get_provisioning_uri(username, issuer_name) img qrcode.make(uri) return img def verify_code(self, username, code): secret self.secrets.get(username) if not secret: return False totp pyotp.TOTP(secret) return totp.verify(code) def disable_mfa(self, username): if username in self.secrets: del self.secrets[username] return True return False3. 性能对比3.1 认证方式对比方式安全性便捷性复杂度密码低高低短信OTP中中中TOTP高中中生物识别高高高3.2 授权模型对比模型灵活性可扩展性复杂度RBAC中中低ABAC高高高PBAC高高中3.3 SSO协议对比协议复杂度安全性适用场景SAML高高企业OAuth 2.0中高Web/MobileOIDC中高统一身份4. 最佳实践4.1 用户认证示例def authentication_example(): auth AuthenticationManager() auth.register_user(testuser, password123, testexample.com) session_id auth.authenticate(testuser, password123) print(fSession ID: {session_id}) username auth.validate_session(session_id) print(fValidated user: {username})4.2 RBAC示例def rbac_example(): rbac RoleBasedAccessControl() rbac.define_role(admin) rbac.define_role(user) rbac.define_permission(create) rbac.define_permission(read) rbac.define_permission(update) rbac.define_permission(delete) rbac.assign_permission_to_role(admin, create) rbac.assign_permission_to_role(admin, read) rbac.assign_permission_to_role(admin, update) rbac.assign_permission_to_role(admin, delete) rbac.assign_permission_to_role(user, read) rbac.assign_role_to_user(admin1, admin) rbac.assign_role_to_user(user1, user) print(fAdmin can delete: {rbac.check_permission(admin1, delete)}) print(fUser can delete: {rbac.check_permission(user1, delete)})5. 总结身份认证与授权是系统安全的基础身份认证验证用户身份角色授权控制访问权限OAuth开放授权协议MFA多因素认证对比数据如下TOTP安全性最高RBAC最常用OAuth 2.0最灵活推荐使用多因素认证身份认证与授权需要结合使用建立完整的身份管理体系。