【认证】Ory Hydra深度解析：企业级OAuth2与OpenID Connect解决方案

# 安装Ory CLI工具
curl -L https://install.ory.sh | bash -s -- -b $HOME/bin

# 初始化项目
ory create project --name "电商平台认证中心"

# 创建客户端凭证
ory create oauth2-client \
  --name "移动端应用" \
  --grant-type client_credentials,authorization_code \
  --redirect-uri https://app.example.com/callback

# 获取访问令牌
ory perform client-credentials \
  --client-id $CLIENT_ID \
  --client-secret $CLIENT_SECRET

# 启用Google Authenticator MFA
ory update oauth2-client $CLIENT_ID \
  --grant-type urn:ietf:params:oauth:grant-type:mfa-oob

// 实现跨设备会话同步
hydraAdmin.AdminApi.CreateLogoutRequest(context.Background()).
    Subject(userID).
    Execute()

# 定义资源范围
scopes:
  - read_profile
  - write_order
  - delete_account

# 查看安全审计日志
ory get audit --project $PROJECT_ID --limit 100