跳到主要内容

附录 A. 其他示例 (Additional Examples)

A.1. OpenID Connect​

OpenID Connect [OpenID.Core] 定义了 claims 参数, 用于请求关于最终用户的身份声明. 该参数可用于 [OpenID.Core] 第 5.5 节定义的授权请求, 或用于 [OpenID.Core] 第 6.1 节定义的请求对象.

使用 RAR 时, 客户端也可以使用类型为 openid_credential 的授权详情对象, 请求签发带有特定声明的 OpenID Connect ID Token. 以下示例展示客户端如何请求签发包含 email 和 email_verified 声明的 ID Token:

[
   {
      "type": "openid_credential",
      "credential_type": "id_token",
      "locations": ["https://example.com"],
      "claims": {
         "email": null,
         "email_verified": null
      }
   }
]

类型为 openid_credential 且 credential_type 为 id_token 的授权详情对象 MAY 包含以下元素:

  • type: REQUIRED. 字符串, 用于确定授权详情类型. 对于签发 OpenID Connect ID Token, 此值 MUST 为 openid_credential.
  • credential_type: REQUIRED. 字符串, 用于确定要签发的凭证类型. 对于 OpenID Connect ID Token, 此值 MUST 为 id_token.
  • locations: OPTIONAL. 字符串数组, 每个字符串表示将使用该凭证的资源服务器 URI.
  • claims: OPTIONAL. 描述要嵌入凭证中的声明的对象. 该值是一个 JSON 对象, 其中被请求声明的名称作为成员名称, 成员值为 null 或 JSON 对象, 用于表达特定声明需求.

A.2. 事务特定授权 (Transaction-Specific Authorization)​

本示例说明如何使用 RAR 表达支付事务的授权. 该示例假定账户之间进行贷记转账.

所使用的 type 值为 payment_initiation, 它是支付发起授权详情类型的标识符 (虚构).

授权请求示例如下:

GET /authorize?response_type=code
   &client_id=s6BhdRkqt3
   &state=af0ifjsldkj
   &redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb
   &code_challenge=K2-ltc83acc4h0c9w6ESC_rEMTJ3bww-uCHaoeK1t8U
   &code_challenge_method=S256
   &authorization_details=%5B%7B%22type%22%3A%22payment_initiation%22%2C%0A%20%20%20%20%20%20%22actions%22%3A%5B%22initiate%22%2C%22status%22%2C%22cancel%22%5D%2C%0A%20%20%20%20%20%20%22locations%22%3A%5B%22https%3A%2F%2Fexample%2Ecom%2Fpayments%22%5D%2C%0A%20%20%20%20%20%20%22instructedAmount%22%3A%7B%0A%20%20%20%20%20%20%20%20%20%22currency%22%3A%22EUR%22%2C%0A%20%20%20%20%20%20%20%20%20%22amount%22%3A%22123%2E50%22%0A%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%22creditorName%22%3A%22Merchant%20A%22%2C%0A%20%20%20%20%20%20%22creditorAccount%22%3A%7B%0A%20%20%20%20%20%20%20%20%20%22iban%22%3A%22DE02100100109307118603%22%0A%20%20%20%20%20%20%7D%2C%0A%20%20%20%20%20%20%22remittanceInformationUnstructured%22%3A%22Ref%20Number%20Merchant%22%0A%20%20%20%7D%5D HTTP/1.1
Host: as.example.com

为便于阅读, 对 authorization_details 参数进行 URL 解码后, 其中包含以下 JSON 文档:

[
   {
      "type": "payment_initiation",
      "actions": ["initiate", "status", "cancel"],
      "locations": ["https://example.com/payments"],
      "instructedAmount": {
         "currency": "EUR",
         "amount": "123.50"
      },
      "creditorName": "Merchant A",
      "creditorAccount": {
         "iban": "DE02100100109307118603"
      },
      "remittanceInformationUnstructured": "Ref Number Merchant"
   }
]

支付发起的授权详情对象包含以下元素:

  • type: REQUIRED. 授权详情的类型, 在本示例中为 payment_initiation.
  • actions: OPTIONAL. 字符串数组, 表示客户端请求授权执行的操作. 在本示例中, initiate 表示创建新支付, status 表示读取支付状态, cancel 表示取消支付.
  • locations: OPTIONAL. 字符串数组, 表示客户端打算使用访问令牌的位置.
  • instructedAmount: REQUIRED. 包含 currency 和 amount 两个元素的对象, 表示要转账的金额.
  • creditorName: REQUIRED. 字符串, 表示商户名称.
  • creditorAccount: REQUIRED. 包含商户账号的对象. 在本示例中, 账户表示为 IBAN (International Bank Account Number), 但也可以使用其他表示方式.
  • remittanceInformationUnstructured: OPTIONAL. 字符串, 表示支付的汇款信息.

A.3. 多个访问令牌 (Multiple Access Tokens)​

本示例说明客户端如何请求授权以签发两个不同的访问令牌, 其中一个用于 payment_api 资源, 另一个用于 account_api 资源.

[
   {
      "type": "payment_initiation",
      "locations": ["https://example.com/payment_api"],
      "instructedAmount": {
         "currency": "EUR",
         "amount": "123.50"
      },
      "creditorName": "Merchant A",
      "creditorAccount": {
         "iban": "DE02100100109307118603"
      }
   },
   {
      "type": "account_information",
      "locations": ["https://example.com/account_api"],
      "accounts": [
         {
            "iban": "DE40100100103307118608"
         },
         {
            "iban": "DE40100100103307118888"
         }
      ]
   }
]

在本示例中, 客户端为两个不同的授权详情对象请求授权:

  1. 一个将在 https://example.com/payment_api 使用的 payment_initiation 授权
  2. 一个将在 https://example.com/account_api 使用的 account_information 授权

如果 AS 决定为每个资源签发单独的访问令牌, 客户端可以发起两个单独的令牌请求:

令牌请求 1 (用于 payment_api):

POST /token HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=SplxlOBeZQQYbYS6WxSbIA
&code_verifier=3641c0461d016ba09c5796b3e7cc5...
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb
&authorization_details=%5B%7B%22type%22%3A%22payment_initiation%22%2C%22locations%22%3A%5B%22https%3A%2F%2Fexample.com%2Fpayment_api%22%5D%7D%5D

令牌请求 2 (用于 account_api):

POST /token HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=SplxlOBeZQQYbYS6WxSbIA
&code_verifier=3641c0461d016ba09c5796b3e7cc5...
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb
&authorization_details=%5B%7B%22type%22%3A%22account_information%22%2C%22locations%22%3A%5B%22https%3A%2F%2Fexample.com%2Faccount_api%22%5D%7D%5D

A.4. 令牌响应中增强的授权详情 (Enriched Authorization Details in Token Response)​

本示例展示了一个类型为 payment_initiation 的授权详情对象, 该对象已由 AS 在令牌响应中使用附加数据进行增强, 例如授权的 date:

{
   "type": "payment_initiation",
   "actions": ["initiate", "status", "cancel"],
   "locations": ["https://example.com/payments"],
   "instructedAmount": {
      "currency": "EUR",
      "amount": "123.50"
   },
   "creditorName": "Merchant A",
   "creditorAccount": {
      "iban": "DE02100100109307118603"
   },
   "remittanceInformationUnstructured": "Ref Number Merchant",
   "date": "2021-08-12"
}

date 字段由 AS 添加, 用于指示授权授予的时间.

最后于 更新