OAuth CIBA detail
OAuth CIBA auth backchannel sans redirect.
Définition
CIBA modes : Poll (client polls /token endpoint), Ping (auth server pings client callback URL), Push (auth server pushes token to client). Backchannel authentication request avec login_hint (subject identifier), binding_message (text shown to user). Client receives auth_req_id et polls / waits. Utilisé Open Banking UK (FAPI CIBA Profile), nordics, Singapore SCA.
Origine
OpenID Foundation FAPI WG, Core 1.0 final 2019, FAPI CIBA Profile 2020.
Usage
Découpled SCA PSD2 (decoupled mobile authenticator), call center auth, voice assistant auth. Implémenté par Curity, ForgeRock, Ping Identity, Keycloak.