openid-connect - OpenID Connect session 管理中的 session 状态

Question

我正在为现有 IDP 开发 OpenID 连接 session 管理。在规范中它提到我们应该将 session 状态从 RP 发送到 OP。我需要知道这里的 session 状态的真正含义。另外我需要知道我应该把什么当作盐值？

Answer 1

此 session 状态值是在原始登录时由 OP 在身份验证响应中提供给 RP 的值。该值对 RP 是不透明的，它只需要跟踪它并将其发送回其 postMessage 中的 OP。从 RP iframe 到 OP 的调用，以便 OP 可以关联它。
正如规范在 http://openid.net/specs/openid-connect-session-1_0.html#CreatingUpdatingSessions 上所说的那样:

When the OP supports session management, it MUST also return the Session State as an additional session_state parameter in the Authentication Response. The OpenID Connect Authentication Response is specified in Section 3.1.2.5 of OpenID Connect Core 1.0.

This parameter is:

session_state
Session State. JSON string that represents the End-User's login state at the OP. It MUST NOT contain the space (" ") character. This value is opaque to the RP. This is REQUIRED if session management is supported.The Session State value is initially calculated on the server. The same Session State value is also recalculated by the OP iframe in the browser client. The generation of suitable Session State values is specified in Section 4.2, and is based on a salted cryptographic hash of Client ID, origin URL, and OP browser state. For the origin URL, the server can use the origin URL of the Authentication Response, following the algorithm specified in Section 4 of RFC 6454 [RFC6454].