GM/T 0069-2019Open identity authentication framework (English PDF)

6.1.1 Overview

The identity service provider is an entity that provides identity authentication services for end users who access the relying party and shall provide the following functions.

6.1.2 Requirements for security management user information

The identity service provider shall securely manage and store the user's identity information, including the subject identifier, name, avatar, gender, date of birth, email address, mobile phone number, residential address and other identity attributes that identify the user. The type of these attribute information is defined and required by the identity service provider according to service needs (see Appendix A).

6.1.3 Requirements for security configuration protocol

The identity service provider shall provide the necessary basic configuration (see Appendix B) to implement the protocol process. First, the identity service provider shall provide the issuer identifier (usually URI), so that the relying party can find the identity service provider when executing the identity service discovery protocol.

6.1.4 Requirements for secure transmission and processing of protocol

messages

7.1 Identification process type

This standard defines three types of identity authentication processes based on different types of relying parties and different needs. The authentication process is executed by the server of the identity service provider.

7.2.1 Overview

This section describes how to use the authorization code-based authentication process to authenticate the end user.

7.2.2 Authorization code process steps

The authorization code process includes the following steps.

7.2.3.1 Authentication request

The authentication request is constructed by the relying party and used to request the authorization server to authenticate the end user.

7.2.3.2 Authentication request validation

After receiving the request, the authorization server shall perform the following validation.

7.2.3.5 Authentication success response

After the end user successfully passes the identity authentication, the authorization endpoint of the identity service provider shall use the "authentication success response" message as defined in this clause to respond to the authentication request message sent by the relying party.

When using the authorization code authentication process, the authorization server shall send the authorization code to the relying party, usually through redirection. The authorization server adds the following parameters to the query component of the redirection endpoint URI (first use UTF-8 to encode the parameters; then use the "application/x-www-form-urlencoded" [RFC1867] format for encoding).

8.1.1 Overview

The protocol defined in this standard mainly involves three types of tokens. ID tokens, access tokens and refresh tokens.

8.1.2 ID token

The ID token is a JSON token containing the authorization claim of the end user;

the body part is a JSON object containing the claim of the end user. See Chapter 9 for the specific content of the claim.

The following is the declaration used in the ID token.

8.2.1 Overview

JSON token is a kind of Javascript object symbol, which is encoded based on the security token, to realize the cross-security domain sharing of identity information and security information. JSON tokens can be used to represent the request parameters of the relying party; it can also be used to represent the authorization information of the end user. The token user can sign and/or encrypt the information contained in the JSON token. If signing and encrypting at the same time, it needs to sign and then encrypt.

8.2.3 Encrypted JSON token

The encrypted JSON token shall contain three parts.

9.1.1 Overview

The claim is the data about the entity generated by the identity service provider, which can be used to express the user's identity attribute information. By passing the claim, the identity service provider provides the end user identity information to the relying party.

9.1.2 Normal claim

The normal claim is represented by a member in the JSON object. The claimed name is used as the member name; the claimed value is used as the member value. The specification defines a set of normal claims (see Appendix A). They can be returned in the user information response (see 9.3.3), or in the ID token (see 8.1.2).

9.3.3 User information successful response

The user information claim shall be returned as a member of a JSON object, unless the customer requires a signature and/or encrypted response during registration. It can return to the claim as defined in Appendix A, or it can return to the claim of the extension not defined in this standard.

GM/T 0069-2019

CRYPTOGRAPHIC INDUSTRY STANDARD ICS 35.040 L 80 Open identity authentication framework Issued on. JULY 12, 2019 Implemented on. JULY 12, 2019 Issued by. State Cryptography Administration

Table of Contents

Foreword... 4

Introduction... 5

1 Scope... 6

2 Normative references... 6

3 Terms and definitions... 7

4 Abbreviations... 11

5 Overview... 12

6 Entity requirements... 14

6.1 Requirements for identity service providers... 14

6.2 Requirements for relying party... 17

7 Identification process... 19

7.1 Identification process type... 19

7.2 Authorization code authentication process... 20

7.3 Implicit authentication flow... 36

7.4 Hybrid authentication flow... 41

7.5 Access token refresh mechanism... 47

8 Token... 49

8.1 Token type... 49

8.2 JSON token... 52

8.3 Token security protection requirements... 55

9 User information access... 57

9.1 Types of claims... 57

9.2 Language and writing claim... 60

9.3 User information endpoint... 60

9.4 User information request claim... 63

9.5 Stability and uniqueness of claim... 67

10 Signature and encryption requirements... 68

10.1 Overview... 68

10.2 Signature... 68

10.3 Encryption... 69

10.4 Entropy of symmetric key... 71

10.5 Order of signature and encryption... 71 Appendix A (Normative) Normal claim... 72 Appendix B (Informative) Basic configuration of identity service provider... 74 Appendix C (Informative) Relying party's registration information... 77 References... 80

9.1.1 Overview

The claim is the data about the entity generated by the identity service provider, which can be used to express the user's identity attribute information. By passing the claim, the identity service provider provides the end user identity information to the relying party.

9.1.2 Normal claim

The normal claim is represented by a member in the JSON object. The claimed name is used as the member name; the claimed value is used as the member value. The specification defines a set of normal claims (see Appendix A). They can be returned in the user information response (see 9.3.3), or in the ID token (see 8.1.2).

9.3.3 User information successful response

The user information claim shall be returned as a member of a JSON object, unless the customer requires a signature and/or encrypted response during registration. It can return to the claim as defined in Appendix A, or it can return to the claim of the extension not defined in this standard.