[Huawei Developers] Freemind R:
More information like this, you can visit HUAWEI Developer Forum​

Opportunity

The vast number of apps are available for download. There are apps intended for specific purposes and there are similar apps intended for the same purposes. As more apps are available, there is a tendency for users to download more apps to address specific needs or maximize the unique features of similar apps for addressing their needs.

Having an immense number of apps brings stiff competition among developers to ensure that their apps stand out among the other apps. For app users, having a lot of apps in their devices could lead to increased password fatigue and complicated username and password management. It would be a win-win solution for both developers and app end users to have a way that enables app users to sign-in to apps in a fast, simple, and secure manner to have a positive user experience resulting to possible faster app adoption.

What is HUAWEI Account Kit?

HUAWEI Account Kit enables developers to add simple, secure, and quick sign-in and authorization functions to their apps. These functions are achieved by the HUAWEI ID sign-in and authorization solution that complies with OAuth.20 and OpenID Connect. The HUAWEI ID sign-in and authorization solution enables stand-alone apps and apps running on independent developer servers to access user authentication information such as an ID token to enable users to quickly and securely sign-in to apps using their HUAWEI IDs.

How to sign in with HUAWEI ID (ID Token)?

Service process for signing in with HUAWEI ID (ID Token)

The following steps explain the process flow for signing in with HUAWEI ID (ID Token):

1. The app sends a sign-in request to HUAWEI Account SDK upon user sign-in using HUAWEI ID.

2. HUAWEI Account SDK informs the user about the content to be authorized using a user sign-in authorization interface based on the authorization scope in the sign-in request.

3. HUAWEI Account SDK sends an ID token to the app after the user authorizes the app to access the content.

4. The app verifies the ID token.

To request authorization for obtaining an ID token:

1. Present the HUAWEI ID sign-in icon on a sign-in page.

2. Send an authorization request by calling HuaweiIdAuthParamsHelper.setIdToken.

HuaweiIdAuthParams authParams = new HuaweiIdAuthParamsHelper(HuaweiIdAuthParams.DEFAULT_AUTH_REQUEST_PARAM).setIdToken().createParams();

3. Initialize HuaweiIdAuthService using getService method of HuaweiIdAuthManager.

HuaweiIdAuthService authService = HuaweiIdAuthManager.getService(MainActivity.this, authParams);

4. Bring up the HUAWEI ID sign-in authorization interface using HuaweiIdAuthService.getSignInIntent.

startActivityForResult(authService.getSignInIntent(), 8888);

5. Obtain HUAWEI ID from the sign-in result by calling HuaweiIdAuthManager.parseAuthResultFromIntent of onActivityResult after completing sign-in authorization.

@Override
protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
//Process the sign-in and authorization result and obtain an ID token from AuthHuaweiId.
super.onActivityResult(requestCode, resultCode, data);
if (requestCode == 8888) {
Task<AuthHuaweiId> authHuaweiIdTask = HuaweiIdAuthManager.parseAuthResultFromIntent(data);
if (authHuaweiIdTask.isSuccessful()) {
//The sign-in is successful, and the user's HUAWEI ID information and ID token are obtained.
AuthHuaweiId huaweiAccount = authHuaweiIdTask.getResult();
Log.i(TAG, "idToken:" + huaweiAccount.getIdToken());
} else {
//The sign-in failed.
Log.e(TAG, "sign in failed : " +((ApiException)authHuaweiIdTask.getException()).getStatusCode());
}
}
}

To verify ID token validity via local verification

Note: Local verification might fail if the current time of the mobile phone is not in sync with the standard time. Make sure that the current time of the mobile phone to be used for local verification is in sync with the standard time.

1. Obtain a public key from the URI obtained from the jwks_uri field at https://oauth-login.cloud.huawei.com/.well-known/openid-configuration.

private void getJwks(ICallBack iCallBack) {
OkHttpClient okHttpClient = new OkHttpClient();
final Request request = new Request.Builder()
.url(Constant.CERT_URL)
.build();
Call call = okHttpClient.newCall(request);
call.enqueue(new Callback() {
@Override
public void onFailure(Call call, IOException e) {
Log.i(TAG, "Get ID Token failed.");
iCallBack.onFailed();
}
@Override
public void onResponse(Call call, Response response) {
if (response.isSuccessful()) {
try {
String res = response.body().string();
JSONObject jsonObject = new JSONObject(res);
mJsonArray = jsonObject.getJSONArray("keys");
iCallBack.onSuccess();
} catch (NullPointerException | JSONException | IOException e) {
Log.i(TAG, "parse JsonArray failed." + e.getMessage());
iCallBack.onFailed();
}
}
}
});
}

NOTE: The public key is updated daily and is cached in the app server.

2. Verify the ID token using JWT library such as jwt.io.

DecodedJWT decoder = JWT.decode(idToken);
Algorithm algorithm = Algorithm.RSA256(mRSAPublicKey , null);
JWTVerifier verifier = JWT.require(algorithm).build();
// verify signature
verifier.verify(decoder);

3. Check if the value of iss is https://accounts.huawei.com.

decoder.getIssuer().equals(ID_TOKEN_ISSUE);

4. Check if the value of aud is the same as the client_id of the app.

decoder.getAudience().get(0).equals(CLIENT_ID);

5. Check if the expiration of the ID token is based on the value of exp.

// Expired, throws TokenExpiredException
verifier.verify(decoder);

If the values of the iss and aud checks out and the expiration of the ID Token is based on the value of exp, the ID token is successfully verified, and the app can use the user information in the sign-in result.

JSONObject jsonObject = new JSONObject(new String(Base64.decode(decoder.getPayload(), Base64.URL_SAFE), DEFAULT_CHARSET));

For the code, you can refer to IDTokenParser.java in the Client Sample Code.

The Benefits

To the developers

Developers can provide a positive user experience to their app users since the app users do not need to undergo a registration and verification process when signing-in to apps using their HUAWEI ID.

To the end user

End users can sign-in to apps in a fast, simple, and secure manner. Minimizes username and password management since end users can sign-in to different apps integrating the Account Kit just by using their HUAWEI ID.

Learn More

To know more information on how to maximize the features and advantages of HUAWEI Account Kit, go to https://developer.huawei.com/consumer/en/hms/huawei-accountkit