An SSO-capable UE shall support 3GPP SSO Authentication, without user intervention, based on Operator-controlled credentials.
An SSO-capable UE shall be able to initiate the SSO Service regardless of the access network technologies supported by the UE.
An SSO-capable UE that supports 3GPP access and non-3GPP access shall support transparency of the SSO Service from a user perspective during transitions between 3GPP access and non-3GPP access, whether or not the transition occurs during a data application session.
An SSO-capable UE may support a request for SSO Local User Authentication from a Data Application Provider or an Identity Provider to confirm the presence of the registered user of the data application.
The 3GPP SSO Service shall provide secure, seamless and transparent access to data applications for users of the SSO Service independent of the access network technology.
The 3GPP SSO Service shall be able to interwork with Identity Management (IdM) specifications (e.g.,
OpenID [51]).
The 3GPP SSO Service shall support 3GPP SSO Authentication based on Operator-controlled credentials and policies.
The 3GPP SSO Service may support negotiation and use of an agreed authentication method between the UE and the 3GPP SSO Identity Provider. The negotiation of an authentication method may be repeated each time the user accesses a DAP's service.
The 3GPP SSO Service may support mechanisms to ensure the presence of the registered user of the data application to satisfy policies of the Data Application Provider.
The 3GPP SSO Service shall be transparent from a user perspective when transitions occur between 3GPP access and non-3GPP access, whether or not the transition occurs during a data application session.
The 3GPP SSO Service shall be transparent from a user perspective when the user accesses a data application using an identity created through a 3rd Party SSO Identity Provider. The user shall be able to configure which 3rd party SSO identities are used with the 3GPP SSO Service.