1"use strict";(self.webpackChunk=self.webpackChunk||[]).push([[7593],{3905:(e,t,n)=>{n.d(t,{Zo:()=>c,kt:()=>v});var a=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function r(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function o(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?r(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):r(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,a,i=function(e,t){if(null==e)return{};var n,a,i={},r=Object.keys(e);for(a=0;a<r.length;a++)n=r[a],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a<r.length;a++)n=r[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=a.createContext({}),u=function(e){var t=a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):o(o({},t),e)),n},c=function(e){var t=u(e.components);return a.createElement(l.Provider,{value:t},e.children)},h="mdxType",d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},p=a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,r=e.originalType,l=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),h=u(n),p=i,v=h["".concat(l,".").concat(p)]||h[p]||d[p]||r;return n?a.createElement(v,o(o({ref:t},c),{},{components:n})):a.createElement(v,o({ref:t},c))}));function v(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var r=n.length,o=new Array(r);o[0]=p;var s={};for(var l in t)hasOwnProperty.call(t,l)&&(s[l]=t[l]);s.originalType=e,s[h]="string"==typeof e?e:i,o[1]=s;for(var u=2;u<r;u++)o[u]=n[u];return a.createElement.apply(null,o)}return a.createElement.apply(null,n)}p.displayName="MDXCreateElement"},3271:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>l,default:()=>v,frontMatter:()=>s,metadata:()=>u,toc:()=>h});var a=n(7462),i=n(3366),r=(n(7294),n(3905)),o=["components"],s={title:"Authentication & Authorization"},l=void 0,u={unversionedId:"learn/hive/features/auth",id:"learn/hive/features/auth",title:"Authentication & Authorization",description:"Traditional Authentication and Authorization",source:"@site/../docs/2.learn/hive/features/auth.md",sourceDirName:"2.learn/hive/features",slug:"/learn/hive/features/auth",permalink:"/learn/hive/features/auth",draft:!1,editUrl:"https://github.com/elastos/Elastos.Wiki/edit/master/website/../docs/2.learn/hive/features/auth.md",tags:[],version:"current",lastUpdatedBy:"Ryan",lastUpdatedAt:1666100198,formattedLastUpdatedAt:"Oct 18, 2022",frontMatter:{title:"Authentication & Authorization"},sidebar:"learnSidebar",previous:{title:"Elastos Hive",permalink:"/learn/hive/intro"},next:{title:"Vault Selection",permalink:"/learn/hive/features/vault-selection"}},c={},h=[{value:"Traditional Authentication and Authorization",id:"traditional-authentication-and-authorization",level:2},{value:"DID-based Authentication and Authorization",id:"did-based-authentication-and-authorization",level:2},{value:"The Whole Flow of Authentication and Authorization on Hive",id:"the-whole-flow-of-authentication-and-authorization-on-hive",level:3},{value:"Conclusion",id:"conclusion",level:2}],d={toc:h},p="wrapper";function v(e){var t=e.components,n=(0,i.Z)(e,o);return(0,r.kt)(p,(0,a.Z)({},d,n,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("h2",{id:"traditional-authentication-and-authorization"},"Traditional Authentication and Authorization"),(0,r.kt)("p",null,"In the traditional Web3 arena, central institutions or organizations generally adopt the following two mechanisms to verify user identities:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Independent user authentication and authorization systems"),(0,r.kt)("li",{parentName:"ul"},"Authentication and authorization systems based on OAuth2 standard protocol")),(0,r.kt)("p",null,"In essence, these are all centralized authentication and authorization systems - all user accounts and credential information are required to be saved on specific central servers, which are obviously controlled and operated by a single institution or organization. From the perspective of internal implementation or operations, once users save their own data on these servers, they're deprived of the ownership and control over the data. Driven by self-interest, these central institutions or operating entities will maliciously audit or even block users from continuing to use services in an unfair way, and even conduct private transactions with users\u2019 private data to seek profits."),(0,r.kt)("h2",{id:"did-based-authentication-and-authorization"},"DID-based Authentication and Authorization"),(0,r.kt)("p",null,"In the user authorization and authentication systems based on DID, the DID itself represents the user identity. All the credential information related to DID is managed and saved by the user, so it's no longer necessary to create a user account on the remote server, nor required to save the user\u2019s private credentials. Users directly authorize third-party applications to use DID and issue access credentials through front-end DID management applications (such as Essentials wallet) and verify user identity and authorize data access rights when accessing remote services."),(0,r.kt)("admonition",{type:"info"},(0,r.kt)("p",{parentName:"admonition"},"Users keep the ownership of vault data with DID-based authentication and authorization mechanism.")),(0,r.kt)("h3",{id:"the-whole-flow-of-authentication-and-authorization-on-hive"},"The Whole Flow of Authentication and Authorization on Hive"),(0,r.kt)("p",null,"Hive deeply integrates DID while realizing the user authentication and authorization mechanisms based on DID. It also supports users by allowing them to access application data from Hive through DID identity. The following entities will be involved in the interaction process of users using Hive services through applications:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Essentials Wallet"),(0,r.kt)("li",{parentName:"ul"},"Third-party applications"),(0,r.kt)("li",{parentName:"ul"},"Hive service")),(0,r.kt)("p",null,"Before users begin to utilize Hive service, they need to apply Essentials Wallet in the front end to create or import the target DID identity, and at the same time ensure that the DID document has been published to the EID sidechain. All subsequent DID-based user authorizations are completed in the Essentials Wallet."),(0,r.kt)("p",null,"When the user logs in to the third-party application, the Essentials wallet should be opened to send a request to the user for authorization of using the target DID. The user clicks on the Essentials Wallet to confirm authorization, and officially logs in to the third-party application through the DID identity."),(0,r.kt)("p",null,"When the third-party application needs to save data in Hive, it requests authorization from the user to access Hive service through Essentials Wallet. After the user confirms and clicks, an access credential will be authorized and issued to the third-party application. The third-party application will then request access to data access services in Hive based on the user DID and access credentials. Hive server verifies the authenticity and validity of DID and access credentials. Once the authentication is passed, the Hive Server will return to the access token, then the third-party application can access the application data in Hive through this access token."),(0,r.kt)("h2",{id:"conclusion"},"Conclusion"),(0,r.kt)("p",null,"Based on DID\u2019s user authentication and authorization, the user authorization verification process is completely placed under their control, while the back-end server only verifies the authenticity and validity of the specific authorized DID identity and credentials. Through the decentralized authentication based on DID, the back-end server no longer needs the user to create accounts and fill in their private information, so it can\u2019t save and manage users\u2019 information in a unified way, thus preventing the server from analyzing user data and then auditing or even shielding the legitimate access rights and interests of ordinary user."))}v.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.