const Token = "abc123"
func checkSignature(signature, timestamp, eventId string) (bool, error) {
    currentTime := time.Now().Unix()
    timeInt, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return false, err
    }
    // 判断timestamp是否已经超时
    if currentTime - timeInt > 30 {
        return false, nil
    }
    //将 Token、timestamp、eventId 三个参数进⾏字典序排序
    toSignParams := []string{Token, timestamp, eventId}
    sort.Strings(toSignParams)
    // 将三个参数字符串，拼接成⼀个字符串进⾏SHA256加密
    signString := ""
    for _, k := range toSignParams {
        signString = signString + k
    }
    h := sha256.New()
    h.Write([]byte(signString))
    computeSignature := h.Sum(nil)
    signatureString := fmt.Sprintf("%x", computeSignature)
    //服务商将加密后的字符串与signature对⽐
    if signature == signatureString {
        return true, nil
    }
    return false, nil
}

function checkSignature($signature, $token, $timestamp, $eventId)
{
 $currentTimestamp = time();
 if ($currentTimestamp - $timestamp > 30) {
 return false;
 }
 $timestamp = (string)$timestamp;
 $eventId = (string)$eventId;
 $params = array($token, $timestamp, $eventId);
 sort($params, SORT_STRING);
 $str = implode('', $params);
 $requestSignature = hash('sha256', $str);
 return $signature === $requestSignature;
}

curl -X POST 'http://isv/interface? signature=e3k9ierw&timestamp=1483944926&eventId=1780012140' --data '{"action":"expireInstance","accountId":"123545678","productId":"7c652d37- e12b-4b4f-aa65-6432d03f12f3","requestId":"ea372177-809d-4722-91d0- d6df4edf7bc9","signId":"kjsadkjhdskjh3k"}'

{"success":"true"}

curl -X POST -H 'Content-Type: application/json' 'http://isv/interface? signature=e3k9ierw&timestamp=1483944926&eventId=1780012140' --data '{"action":"modifyInstance","orderId":"20170109199524","accountId":"123545678" ,"productId":"7c652d37-e12b-4b4f-aa65-6432d03f12f3","requestId":"1d8326b2- 9a94-4bf3-91ce-c7a94add99d3","signId":"kjsadkjhdskjh3k","spec":" ⾼高级 版","timeSpan":2,"timeUnit":"m"," instanceExpireTime":"2017-02-09 19:59:59" }'

{"success":"true"}

curl -X POST 'http://isv/interface? signature=e3k9ierw&timestamp=1483944926&eventId=1780012140' --data '{"action":"destroyInstance","orderId":"20170109199524","accountId":"123545678","productId":1024,"requestId":"80b75030-6571-46a8-87ef-5b414f66dc39","signId":"kjsadkjhdskjh3k"}'

{"success":"true"}

import jwt
from cryptography import x509
from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization
def verify_id_token(id_token, certificate):
cert = x509.load_pem_x509_certificate(certificate, default_backend()) public_key = cert.public_key()
public_key_bytes = public_key.public_bytes(serialization.Encoding.PEM,
serialization.PublicFormat.SubjectPublicKeyInfo)
decoded = jwt.decode(id_token, key = public_key_bytes, algorithms =
'RS256')

import jwt
from cryptography import x509
from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization
def verify_id_token(id_token, certificate):
cert = x509.load_pem_x509_certificate(certificate, default_backend()) public_key = cert.public_key()
public_key_bytes = public_key.public_bytes(serialization.Encoding.PEM,
serialization.PublicFormat.SubjectPublicKeyInfo)
decoded = jwt.decode(id_token, key = public_key_bytes, algorithms =
'RS256')

注意：地市云在SSO免登和统一认证时，使用了千帆玉符的能力。相关的支持由千帆玉符侧同事来给予支持。

https://xxxx-idp.cig.tencentcs.com/xxx/authorize?response_type=code&client_id=xxxx&redirect_uri=https://xxxx.client.com/callback&scope=openid%20offline_access&state=xxxx

https://xxxx.client.com/callback?code=xxx&state=xxxx

POST  https://xxxx-idp.cig.tencentcs.com/xxx/token 

Content-Type:  application/x-www-form-urlencoded 
Authorization: Basic {Base64:[client_id:client_secret]}

grant_type=authorization_code&code={code}&redirect_uri=https://xxxx.client.com/callback

HTTP/1.1  200 OK 
 Content-Type: application/json 

{
    "id_token": "xxxx",
    "access_token": "xxxxxxx",
    "refresh_token": "xxxxxxxxx",
    "token_type": "Bearer",
    "expires_in": 3600
}

GET  https://xxxx-idp.cig.tencentcs.com/xxx/userinfo 

Content-Type:  application/json 
Authorization: Bearer {access_token}

HTTP/1.1  200 OK 
Content-Type: application/json 

{
    "sub": "zhangsan",
    "name": "张三",
    "email":"zhangsan@tencent.com",
    "phoneNumber":"12345678901"
}

POST  https://xxxx-idp.cig.tencentcs.com/xxx/token 
Content-Type:  application/x-www-form-urlencoded 
Authorization: Basic {Base64:[client_id:client_secret]}

grant_type=refresh_token
refresh_token={refresh_token}

HTTP/1.1  200 OK 
Content-Type: application/json 

{
    "access_token": "xxxxxxx",
    "refresh_token":"xxxxxxxxx",
    "token_type": "Bearer",
    "expires_in": 3600   
}

1. 合作方应用自身需要实现界面点击登出功能，并重定向到千帆玉符。 
2. 合作方应用需要具备后台登出用户的能力，接收千帆玉符发送的登出请求，注意与界面登出功能区分开。 
3. 在下文的讨论中，根据登出行为的发起者不同，将这两种登出行为分为“由合作方应用发起的登出”和“由千帆玉符发起的登出”。合作方应用开发者需要区分这二者的区别。

https://xxxx-idp.cig.tencentcs.com/logout?return_to=https://xxx.client.com/logout

https://xxx.client.com/logout

POST https://xxx.client.com/backchannel_logout HTTP/1.1
  Content-Type: application/x-www-form-urlencoded

  logout_token=eyJhbGci ... .eyJpc3Mi ... .T3BlbklE ...

{
  "iss": "https://server.example.com",
  "sub": "sanzhang@demo.com",
  "sid": "xxx",
  "aud": "ai-xxx",
  "iat": 1577808000,
  "exp": 1577808600,
  "jti": "bWJq"
}