QQ、Sina等OAuth2.0接入

OAuth2.0技术比较实用，像我这种反感注册的用户一般都是申请一个没用的QQ，然后用这个QQ登录那些不想注册，有点小用的系统。技术不多说，拿QQ来说，简单列几点：

1.QQ给第三方平台分配一个appkey和appsecret

2.用户选择使用QQ账号登录第三方平台，此时，第三方平台使用自己的appkey获取code，code是在用户输入QQ账号密码后生成的，是与QQ那边交互的，并且生命周期很短，是安全的

3.第三方平台获取到code后，再使用code+appkey+appsecret获取access_token

4.第三方平台获取到access_token后，便可使用该access_token获取openid，进而使用openid+access_token+appkey获取用户信息

5.此时用户已认证成功，第三方平台可使用该用户的唯一标示openid来创建账号

tornado框架封装的OAuth2Mixin：

class OAuth2Mixin(object):    """Abstract implementation of OAuth 2.0.    See `FacebookGraphMixin` below for an example implementation.    Class attributes:    * ``_OAUTH_AUTHORIZE_URL``: The service's authorization url.    * ``_OAUTH_ACCESS_TOKEN_URL``:  The service's access token url.    """    @return_future    def authorize_redirect(self, redirect_uri=None, client_id=None,                           client_secret=None, extra_params=None,                           callback=None):        """Redirects the user to obtain OAuth authorization for this service.        Some providers require that you register a redirect URL with        your application instead of passing one via this method. You        should call this method to log the user in, and then call        ``get_authenticated_user`` in the handler for your        redirect URL to complete the authorization process.        .. versionchanged:: 3.1           Returns a `.Future` and takes an optional callback.  These are           not strictly necessary as this method is synchronous,           but they are supplied for consistency with           `OAuthMixin.authorize_redirect`.        """        args = {            "redirect_uri": redirect_uri,            "client_id": client_id        }        if extra_params:            args.update(extra_params)        self.redirect(            url_concat(self._OAUTH_AUTHORIZE_URL, args))        callback()    def _oauth_request_token_url(self, redirect_uri=None, client_id=None,                                 client_secret=None, code=None,                                 extra_params=None):        url = self._OAUTH_ACCESS_TOKEN_URL        args = dict(            redirect_uri=redirect_uri,            code=code,            client_id=client_id,            client_secret=client_secret,        )        if extra_params:            args.update(extra_params)        return url_concat(url, args)

QQ Oauth2.0封装：

class QQGraphOAuth2Mixin(OAuth2Mixin):    _OAUTH_AUTHORIZE_URL = "https://graph.qq.com/oauth2.0/authorize?"    _OAUTH_ACCESS_TOKEN_URL = "https://graph.qq.com/oauth2.0/token?"    _OAUTH_OPENID_URL = "https://graph.qq.com/oauth2.0/me?"    _OAUTH_NO_CALLBACKS = False    _QQ_BASE_URL = "https://graph.qq.com"    @_auth_return_future    def get_authenticated_user(self, redirect_uri, client_id, client_secret,                               code, callback, extra_fields=None, extra_params=None):        http = self.get_auth_http_client()        args = {            "redirect_uri": redirect_uri,            "code": code,            "client_id": client_id,            "client_secret": client_secret,            "extra_params": extra_params,        }        http.fetch(self._oauth_request_token_url(**args),                   self.async_callback(self._on_access_token, redirect_uri, client_id,                                       client_secret, callback, extra_fields))    def _on_access_token(self, redirect_uri, client_id, client_secret,                         future, extra_fields, response):        if response.error:            future.set_exception(AuthError('QQ auth error: %s' % str(response)))            return        args = escape.parse_qs_bytes(escape.native_str(response.body))        session = {            "access_token": args["access_token"][-1],            "expires_in": args["expires_in"][-1],            "refresh_token": args["refresh_token"][-1],            "client_id": client_id,        }        http = self.get_auth_http_client()        http.fetch(self._oauth_request_openid(session["access_token"]),                   self.async_callback(self._on_open_id, future, session, extra_fields))    def _on_open_id(self, future, session, extra_fields, response):                if response.error:            future.set_exception(AuthError('QQ auth error: %s' % str(response)))            return        response = response.body.replace("callback( ", "").replace(" );", "")        args = escape.json_decode(response)        session["openid"] = str(args["openid"])        fields = set(['ret', 'msg', 'nickname'])        if extra_fields:            fields.update(extra_fields)                    self.qq_request(            path="/user/get_user_info",            callback=self.async_callback(                self._on_get_user_info, future, session, fields),            access_token=session["access_token"],            openid=session["openid"],            oauth_consumer_key=session["client_id"],            fields=",".join(fields)        )        def _on_get_user_info(self, future, session, fields, user):        if user is None:            future.set_result(None)            return        fieldmap = {}        for field in fields:            fieldmap[field] = user.get(field)        fieldmap.update(session)        future.set_result(fieldmap)    @_auth_return_future    def qq_request(self, path, callback, access_token=None,                         post_args=None, **args):        url = self._QQ_BASE_URL + path        all_args = {}        if access_token:            all_args["access_token"] = access_token            all_args.update(args)        if all_args:            url += "?" + urllib_parse.urlencode(all_args)        callback = self.async_callback(self._on_qq_request, callback)        http = self.get_auth_http_client()        if post_args is not None:            http.fetch(url, method="POST", body=urllib_parse.urlencode(post_args),                       callback=callback)        else:            http.fetch(url, callback=callback)    def _on_qq_request(self, future, response):        if response.error:            future.set_exception(AuthError("Error response %s fetching %s" %                                           (response.error, response.request.url)))            return        future.set_result(escape.json_decode(response.body))    def get_auth_http_client(self):        return httpclient.AsyncHTTPClient()        def _oauth_request_openid(self, access_token):        return self._OAUTH_OPENID_URL + "access_token=" + access_token

Sina OAuth2封装（与QQ基本一致）：

class SinaGraphOAuth2Mixin(OAuth2Mixin):    _OAUTH_AUTHORIZE_URL = "https://api.weibo.com/oauth2/authorize?"    _OAUTH_ACCESS_TOKEN_URL = "https://api.weibo.com/oauth2/access_token?"    _OAUTH_NO_CALLBACKS = False    _OAUTH_SINA_BASE_URL = "https://api.weibo.com/2"    @_auth_return_future    def get_authenticated_user(self, redirect_uri, client_id, client_secret,                               code, callback, extra_fields=None, extra_params=None):                post_args = {            "client_id" : client_id,            "client_secret" : client_secret,            "grant_type" : "authorization_code",            "redirect_uri" : redirect_uri,            "code" : code        }        self.sina_request(            path="https://api.weibo.com/oauth2/access_token",            callback=self.async_callback(self._on_access_token, callback, extra_fields),            post_args = post_args,        )    def _on_access_token(self, future, extra_fields, response):        if response is None:            future.set_result(None)            return                fields = set(['error_code', 'error', 'id', 'screen_name'])        if extra_fields:            fields.update(extra_fields)        self.sina_request(            path=self._OAUTH_SINA_BASE_URL+"/users/show.json",            callback=self.async_callback(self._on_get_user_info, future, fields),            access_token=response["access_token"],            uid=response["uid"]        )    def _on_get_user_info(self, future, fields, user):        if user is None:            future.set_result(None)            return        fieldmap = {}        for field in fields:            fieldmap[field] = user.get(field, "")        future.set_result(fieldmap)    @_auth_return_future    def sina_request(self, path, callback, access_token=None,                         post_args=None, **args):        url = path        all_args = {}        if access_token:            all_args["access_token"] = access_token            all_args.update(args)        if all_args:            url += "?" + urllib_parse.urlencode(all_args)        callback = self.async_callback(self._on_sina_request, callback)        http = self.get_auth_http_client()        if post_args is not None:            http.fetch(url, method="POST", body=urllib_parse.urlencode(post_args),                       callback=callback)        else:            http.fetch(url, callback=callback)    def _on_sina_request(self, future, response):        if response.error:            future.set_exception(AuthError("Error response %s fetching %s" %                                           (response.error, response.request.url)))            return        future.set_result(escape.json_decode(response.body))    def get_auth_http_client(self):        return httpclient.AsyncHTTPClient()

使用（获取到用户信息直接登录）：

class QQGraphLoginHandler(BaseHandler, QQGraphOAuth2Mixin):    @tornado.web.asynchronous    def get(self):        my_url = (self.request.host.replace("localhost", "127.0.0.1") +                  "/qqlogin?next=" +                  tornado.escape.url_escape(self.get_argument("next", "/")))        if self.get_argument("code", False):            self.get_authenticated_user(                redirect_uri=my_url,                client_id=self.settings["qq_api_key"],                client_secret=self.settings["qq_api_secret"],                code=self.get_argument("code"),                extra_params={"grant_type": "authorization_code"},                callback=self._on_auth)            return        self.authorize_redirect(redirect_uri=my_url,                                client_id=self.settings["qq_api_key"],                                extra_params={"response_type": "code"})    def _on_auth(self, user):        if not user:            raise tornado.web.HTTPError(500, "qq auth failed")        #user: openid, nickname        uid = user.get("openid", 0)        nick = user.get("nickname", uid)#default uid        if user.get("ret", 0) or not uid:            self.render('error.html', msg = user.get('msg', 'error'))        else:            ZQ_Account().login(uid, nick, "QQ", self._on_login)    def _on_login(self, result, ex):        if not ex:            self.set_secure_cookie(settings.MGR_USER_COOKIE_KEY, json_encode(result) , expires_days = 1)            self.redirect(self.get_argument("next", "/"))        else:            self.writeError(result)class SinaGraphLoginHandler(BaseHandler, SinaGraphOAuth2Mixin):    @tornado.web.asynchronous    def get(self):        my_url = ("http://" + self.request.host.replace("localhost", "127.0.0.1") +#必须要http://                  "/sinalogin")        if self.get_argument("code", False):            self.get_authenticated_user(                redirect_uri=my_url,                client_id=self.settings["sina_api_key"],                client_secret=self.settings["sina_api_secret"],                code=self.get_argument("code"),                extra_params={"grant_type": "authorization_code"},                callback=self._on_auth)            return        self.authorize_redirect(redirect_uri=my_url,                                client_id=self.settings["sina_api_key"],                                extra_params={"response_type": "code"})    def _on_auth(self, user):        if not user:            raise tornado.web.HTTPError(500, "sina auth failed")        #user: id, screen_name        uid = user.get("id", 0)        nick = user.get("screen_name", uid)#default uid        if user.get("error_code", 0):            self.render('error.html', msg = user.get('error'))        else:            ZQ_Account().login(uid, nick, "SINA", self._on_login)        def _on_login(self, result, ex):        if not ex:            self.set_secure_cookie(settings.MGR_USER_COOKIE_KEY, json_encode(result) , expires_days = 1)            self.redirect(self.get_argument("next", "/"))        else:            self.writeError(result)

QQ OAuth直接参考官方文档即可，很详细：
http://wiki.connect.qq.com/

Sina OAuth官方文档有点乱，可参考：
http://jingyan.baidu.com/article/455a99508c91c8a166277893.html
http://rsj217.diandian.com/post/2013-04-17/40050093587