What is CIBA?

CIBA allows clients to initiate an authentication request to an Authorization Server (AS) without requiring the user to be present at the time of the request. The AS then notifies the user out-of-band (e.g., via SMS, email, push notification) to authenticate. Once the user authenticates, the AS sends an authentication result back to the client.

Why use CIBA?

Use CIBA when:

• You need to authenticate users without their immediate presence.
• Implementing traditional OAuth 2.0 flows is impractical due to user unavailability.
• Enhancing security by decoupling the authentication request from the user interaction.

How does CIBA work?

CIBA involves several key components and steps:

1. Client Registration: The client registers with the AS, specifying support for CIBA.
2. Authentication Request: The client initiates a backchannel authentication request to the AS.
3. User Notification: The AS notifies the user out-of-band to authenticate.
4. User Authentication: The user authenticates through the provided method.
5. Authentication Result: The AS sends the authentication result to the client.

Client Registration

Before using CIBA, the client must register with the AS and specify support for CIBA. This typically involves setting the backchannel_authentication_endpoint and other related parameters during registration.

{
  "client_id": "my-client",
  "client_secret": "supersecret",
  "redirect_uris": ["https://client.example.com/callback"],
  "grant_types": ["authorization_code", "urn:ietf:params:oauth:grant-type:ciba"],
  "response_types": ["code"],
  "scope": "openid profile",
  "backchannel_authentication_endpoint": "https://as.example.com/ciba/auth",
  "token_endpoint": "https://as.example.com/token"
}

Authentication Request

The client initiates a backchannel authentication request to the AS using the backchannel_authentication_endpoint. The request includes necessary parameters such as scope, client_id, and client_secret.

POST /ciba/auth HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

client_id=my-client
&client_secret=supersecret
&scope=openid%20profile
&binding_message=Please%20authenticate%20for%20my-client
&requested_expiry=3600
&user_code=abc123

User Notification

Upon receiving the authentication request, the AS notifies the user out-of-band. This could be via SMS, email, or any other communication channel supported by the AS.

User Authentication

The user authenticates through the provided method. This could involve entering a code, clicking a link, or using a mobile app.

Authentication Result

Once the user authenticates, the AS sends the authentication result to the client. The result includes an authentication request ID and a status indicating success or failure.

POST /callback HTTP/1.1
Host: client.example.com
Content-Type: application/json

{
  "auth_req_id": "req123",
  "expires_in": 3600,
  "interval": 5,
  "status": "pending"
}

Handling Authentication Result

The client polls the AS using the auth_req_id to check the status of the authentication request.

POST /token HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:ciba
&client_id=my-client
&client_secret=supersecret
&auth_req_id=req123

If the authentication is successful, the AS returns an access token.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Security Considerations

Implementing CIBA requires careful consideration of security aspects to ensure the integrity and confidentiality of the authentication process.

Protect Client Secrets

Client secrets must stay secret - never commit them to git or expose them in client-side code.

Validate Authentication Requests

Always validate the authentication request to ensure it comes from a trusted source. Check the client_id, scope, and other parameters.

Prevent Replay Attacks

Implement measures to prevent replay attacks, such as using unique auth_req_id values and checking the expiration time.

Secure Communication Channels

Use HTTPS to encrypt all communications between the client, AS, and user. This protects sensitive data from interception.

Comparison of Authentication Flows

Common Pitfalls

Avoid common pitfalls when implementing CIBA to ensure a smooth and secure authentication process.

Incorrect Endpoint Configuration

Ensure the backchannel_authentication_endpoint and token_endpoint are correctly configured in the client registration.

Missing Required Parameters

Include all required parameters in the authentication request, such as client_id, client_secret, and scope.

Insecure Communication

Always use HTTPS to encrypt all communications between the client, AS, and user.

Real-world Example

Let’s walk through a real-world example of implementing CIBA in a smart home device.

Step-by-Step Guide

Register the Client

Register the smart home device with the AS using the following request:

POST /register HTTP/1.1
Host: as.example.com
Content-Type: application/json

{
  "client_id": "smart-home-device",
  "client_secret": "device-secret",
  "redirect_uris": ["https://device.example.com/callback"],
  "grant_types": ["urn:ietf:params:oauth:grant-type:ciba"],
  "response_types": ["token"],
  "scope": "openid profile",
  "backchannel_authentication_endpoint": "https://as.example.com/ciba/auth",
  "token_endpoint": "https://as.example.com/token"
}

Initiate Authentication Request

Initiate a backchannel authentication request to the AS:

POST /ciba/auth HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

client_id=smart-home-device
&client_secret=device-secret
&scope=openid%20profile
&binding_message=Please%20authenticate%20your%20smart%20home%20device
&requested_expiry=3600
&user_code=xyz789

Handle Authentication Result

Poll the AS for the authentication result:

POST /token HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:ciba
&client_id=smart-home-device
&client_secret=device-secret
&auth_req_id=req456

If the authentication is successful, the AS returns an access token:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Conclusion

CIBA provides a powerful mechanism for decoupled authentication flows, enabling secure access without immediate user interaction. By understanding the protocol and implementing best practices, you can enhance the security and functionality of your applications.

Implement CIBA today and improve the security and flexibility of your authentication processes.