OAuth CIBA detail
OAuth CIBA backchannel auth without redirect.
Definition
CIBA modes: Poll (client polls /token endpoint), Ping (auth server pings client callback URL), Push (auth server pushes token to client). Backchannel authentication request with login_hint (subject identifier), binding_message (text shown to user). Client receives auth_req_id and polls / waits. Used in UK Open Banking (FAPI CIBA Profile), Nordics, Singapore SCA.
Origin
OpenID Foundation FAPI WG, Core 1.0 final 2019, FAPI CIBA Profile 2020.
Usage
Decoupled PSD2 SCA (decoupled mobile authenticator), call center auth, voice assistant auth. Implemented by Curity, ForgeRock, Ping Identity, Keycloak.