ISO/IEC 26135:2024 PDF

Name: ISO/IEC 26135:2024 — Information technology — OpenID connect — OpenID connect session management 1.0
SKU: ISO/IEC 26135:2024
Price: 25 EUR
Availability: InStock

Information technology — OpenID connect — OpenID connect session management 1.0

Название (английский):

ISO/IEC 26135:2024

Information technology — OpenID connect — OpenID connect session management 1.0

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 12
Дата публикации:: 1 октября 2024 г.
Издание:: ISO/IEC IS 26135 edition 1 version 1
ICS:: 35.030

Тип поставки:

Full version180 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:2 раб. дн. (перевод)

Цена:180 €

Описание (английский):

OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. This document describes how to manage sessions for OpenID Connect, including when to log out the End-User.

Abstract

Похожие стандарты

Другие стандарты ISO

ISO/IEC 26135:2024 - Overview

ISO/IEC 26135:2024, "Information technology - OpenID Connect - OpenID Connect session management 1.0", standardizes how OpenID Connect (an identity layer on top of OAuth 2.0) manages user sessions and coordinates logout behavior between OpenID Providers (OPs) and Relying Parties (RPs). It defines lightweight, front‑channel mechanisms to detect changes in an End‑User’s login state (so RPs can update or terminate local sessions) without frequent network polling.

Key topics and technical requirements

Session State (session_state): an opaque JSON string returned in the authentication response. It MUST NOT contain spaces and is used to represent the End‑User’s login state at the OP.

Session creation/updating: RPs start sessions upon validating an ID Token (see OpenID Connect Core 1.0). OPs MUST return session_state when supporting session management.

RP iframe / OP iframe architecture:

The RP loads an invisible RP iframe that periodically sends a postMessage containing "ClientID + ' ' + session_state" to the OP iframe.
The OP exposes a check_session_iframe that recalculates the session state from Client ID, source origin, OP user agent state and a salt, then replies with "unchanged", "changed", or "error".

State verification and re‑authentication:

On "changed", RPs SHOULD perform an iframe prompt=none request (sending id_token_hint) to obtain an updated ID Token/session_state and treat mismatches as logout.
On "error", RPs MUST NOT attempt prompt=none to avoid loops.

Security controls:

Strict origin validation on postMessage exchanges; reject unexpected origins to prevent XSS/CSS attacks.
OPs should avoid placing identifying user data in JavaScript‑accessible cookies (HttpOnly may not be usable).

Implementation notes: guidance on salt randomness, OP user agent state management, and IANA registries for OAuth parameters and metadata.

Applications and who should use it

Identity providers, authorization server implementers, and OpenID Provider developers who need standardized session tracking and logout propagation.

Web and mobile application developers (Relying Parties) integrating OpenID Connect for single sign‑on (SSO) and coordinated logout.

Security architects and SSO integrators seeking interoperable, low‑traffic session notifications across domains.

Related standards

OpenID Connect Core 1.0 (authentication, ID Tokens)

OpenID Connect Front‑Channel Logout 1.0

OpenID Connect Back‑Channel Logout 1.0

OpenID Connect RP‑Initiated Logout 1.0

OAuth 2.0 (RFC 6749)

This standard helps implement robust, interoperable session management for OpenID Connect deployments, minimizing client polling while ensuring secure logout and session integrity.

ISO/IEC 26135:2024 PDF

Abstract

Похожие стандарты

ISO/IEC 26135:2024 - Overview

Key topics and technical requirements

Applications and who should use it

Related standards

Технические детали

ISO 8689-1:2000

Water quality — Biological classification of rivers — Part 1: Guidance on the interpretation of biological qu…

ISO/ASTM51540-04(2012)

Standard Practice for Use of a Radiochromic Liquid Dosimetry System (Withdrawn 2020)

ISO/ASTM51204-04

Standard Practice for Dosimetry in Gamma Irradiation Facilities for Food Processing (Withdrawn 2013)

ISO/ASTM51431-05

Standard Practice for Dosimetry in Electron Beam and X-Ray (Bremsstrahlung) Irradiation Facilities for Food P…

ISO/ASTM52628-20e1

Standard Practice for Dosimetry in Radiation Processing

ISO/ASTM52921-13(2019)

Standard Terminology for Additive Manufacturing—Coordinate Systems and Test Methodologies

ISO/ASTMTR52917-EB

Additive Manufacturing — Round Robin Testing — General Guidelines

ISO/ASTM52901-17(2023)

Standard Guide for Additive Manufacturing – General Principles – Requirements for Purchased AM Parts