T/CAICIT/CAICI91—2024統一認證能力要求UnifiedAuthenticatio2024-08-26發布2024-09-15實施中國通信企業協會發布I III 2 2 2 3 3 3 3 3 5 5 5 5 6 6 6 II III12BIR3<characteristictype="MESSAGING"><characteristictype="Singlesign-on"><parmname="SSOURI"value="/ssoserver"/></characteristic></characteristic>41)通過GBA開放平臺跳轉到MM—MM—M應用的頁面，由第三方應用提供，主域名應在其開通M—M—M—5應用系統向用戶發送的Chatbot消息，并轉發給終端；負責為第三方應用系統開通統一認證能力接口①：第三方應用系統與統一認證能力開通邏輯模塊間的接口，完成統一認證能力開通相關的6接口⑥：GBA認證能力開放平臺與第三方應用系統間的第三方應用到GBA認證能力開放平臺申請開通統一認證能力，流程如圖2所示。1．第三方應用系統申請開通統一認證能力，攜帶第三方應用的企業名稱、管理者身份、Chatbot交互，獲得登錄后的第三方應用網頁。用戶獲取授權頁面流程如圖3所示，用戶確認授權流程如圖478—機制1：直接訪問GBA認證能力開放平臺。5’～7’：外鏈直接指向GBA認證能力開放平臺，數。GBA認證能力開放平臺對appid和回調URL進行校驗，如果校驗通過，則返回授權確認頁面，攜帶預授權code;如果校驗不通過，則返回校驗不通過的結果及不通過的原因提示頁面。9放平臺獲得用戶取消授權的結果后，記錄該事名跟回調url的域名是否一致。執行GBA認證的后續流程，獲得用戶的IMPU和IMPI，并保存緩存信息；GBA認證能力開放平8.1第三方應用系統與統一認證能力開通模塊間的接口（接口1）請求地址：/gbaop/v1/auth/codeMM無無M無GET/gbaop/v1/auth/codeHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTX-3GPP-Intended-Identity:sip:+8613911111111@Connection:Keep-AliveContent-Length:0HTTP/1.1401UnauthorizedServer:Apache/1.3.22(Unix)mod_perl/1.27Date:Thu,24July201910:50:35GMTWWW-Authenticate:Digestrealm="3GPP-bootstrapping@ftcontentserver.rcs.mnc00.",nonce="6629fae49393a05397450978507c4ef1",algorithm=AKA_v1_SHA256,qop="auth,auth-int",opaque="5ccc069c403ebaf9f0171e9517f30e41"MMMMMMCOMGET/gbaop/v1/auth/code?pre_auth_code=kdflsflsdkfHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTX-3GPP-Intended-Identity:+8613844445678Authorization:Digestusername="(B-TID)",realm="3GPP-bootstrapping@",nonce="a6332ffd2d234==",uri="/",qop=auth-int,nc=00000001,cnonce="6629fae49393a05397450978507c4ef1",response="6629fae49393a05397450978507c4ef1",opaque="5ccc069c403ebaf9f0171e9517f30e41",algorithm=SHA-256Connection:Keep-AliveContent-Length:0HTTP/1.1200OKAccess-Control-Allow-Origin:*Content-Type:application/json;charset=UTF-8Transfer-Encoding:chunkedDate:Mon,09Nov202002:03:33GMTKeep-Alive:timeout=60Connection:keep-alive{"code":"0","data":{"redirect_uri":"/cb?auth_code=SplxlOBeZQQYbYS6WxSbIA&state=xyz"},"message":"OK"}消授權2個場景。MXXXXM無M無POST/gbaop/v1/auth/cancel?pre_auth_code=kdflsflsdkfHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTConnection:Keep-AliveContent-Length:0HTTP/1.1302FoundLocation:/cb?state=xyzMMMMOMMMCOMGET/gbaop/v1/auth/code?appid=XX&domain=XX&scope=XXHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTX-3GPP-Intended-Identity:+8613844445678Authorization:Digestusername="(B-TID)",realm="3GPP-bootstrapping@",nonce="a6332ffd2d234==",uri="/",qop=auth-int,nc=00000001,cnonce="6629fae49393a05397450978507c4ef1",response="6629fae49393a05397450978507c4ef1",opaque="5ccc069c403ebaf9f0171e9517f30e41",algorithm=SHA-256Connection:Keep-AliveContent-Length:0HTTP/1.1200OKAccess-Control-Allow-Origin:*Content-Type:application/json;charset=UTF-8Transfer-Encoding:chunkedDate:Mon,09Nov202002:03:33GMTKeep-Alive:timeout=60Connection:keep-alive{"code":"0","data":{"auth_code":"XXXX"},"message":"OK"}8.7第三方應用系統與GBA認證能力開放平臺間的接口（接口6）MXXXXMMMO運營商可根據實際情況擴展其他值，用于開放OO無MMMCOM0/gbaop/v1/authorizepage?response_type=code&appid=s6BhdRkqt3&state=xyz&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2FcbHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTX-3GPP-Intended-Identity:sip:+8613911111111@Connection:Keep-AliveContent-Length:0HTTP/1.1200OKAccess-Control-Allow-Origin:*Content-Type:application/json;charset=UTF-8Transfer-Encoding:chunkedDate:Mon,09Nov202002:03:33GMTKeep-Alive:timeout=60Connection:keep-alive{"code":"0","data":{"auth_url":"/gbaopv/index.html?pre_auth_code=S},"message":"OK"}M無MMMM無MMCOMMMOOPOST/gbaop/v1/auth/tokenHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTContent-Type:application/jsonConnection:Keep-AliveContent-Length:45{"grant_type":"authorization_code","auth_code":"dfdfsdf","redirect_uri":"https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb","appid":"fhfghgfhgfh","appsecret":"dfdfsdf"}HTTP/1.1200OKAccess-Control-Allow-Origin:*Content-Type:application/json;charset=UTF-8Transfer-Encoding:chunkedDate:Mon,09Nov202002:03:33GMTKeep-Alive:timeout=60Connection:keep-alive{"code":"0","data":{"access_token":"d2bbd4f22a0f9050e2fb17f2bdaa0bef","token_type":"bearer","expires_in":3600,"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA","scope":"telnum"},"message":"OK"}期，更新為新的，如果沒過期，僅僅更新有效期，采用HTTPS請求和M無M無MMCOMMM過期時間，單位為秒。如果省略該參數，應以其OOPOST/gbaop/v1/auth/refreshtokenHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTContent-Type:application/jsonConnection:Keep-AliveContent-Length:45{"refresh_token":"d2bbd4f22a0f9050e2fb17f2bdaa0bef"}HTTP/1.1200OKAccess-Control-Allow-Origin:*Content-Type:application/json;charset=UTF-8Transfer-Encoding:chunkedDate:Mon,09Nov202002:03:33GMTKeep-Alive:timeout=60Connection:keep-alive{"code":"0","data":{"access_token":"d2bbd4f22a0f9050e2fb17f2bdaa0bef","token_type":"bearer","expires_in":3600,"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA","scope":"telnum"},"message":"OK"}第三方應用系統通過本接口向GBA認證能力開放平臺查詢用戶的身份信息（手機號碼采用MM無無MMCOMGET/gbaop/v1/auth/phonenum?access_token=ACCESS_TOKENHTTP/1.1User-Agent:NAF1ApplicationAgentRelease-63gpp-gbaDate:Thu,08Jan201910:50:35GMTX-3GPP-Intended-Identity:sip:+8613911111111@Connection:Keep-AliveContent-Length:0HTTP/1.1200OKSet-Cookie:reme