IBibm
Backchannel Authentication Endpoint

Use this endpoint to initiate backchannel authentication

Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.

post/ciba

Request

  • Base URL
    https://{pointofcontact}/oauth2
  • Auth
    HTTP basic

Headers

x-client-certificatestring

MTLS Client Certificate

Request body application/x-www-form-urlencoded

requeststring

Request object, signed and/or encrypted JWT. When used, it may contain all the properties below. Besides parameters used by client authentication, all the other parameters should be inside the request object.

scopestring required

Space-delimited string indicating the OAuth 2.0 scope to be associated with the access request.

client_notification_tokenstring

A bearer token provided by the Client that will be used by the OIDC Provider to authenticate the callback request to the Client. This is required when "ping" token delivery mode is used.

acr_valuesstring

A space-separated string that specifies the requested Authentication Context Class Reference values, with the values appearing in order of preference.

login_hint_tokenstring

An ID Token (JWT) previously issued to the Client by the OIDC Provider being passed back as a hint to identify the end-user for whom authentication is being requested. One of 'login_hint_token', 'id_token_hint' or 'login_hint' MUST be specified.

id_token_hintstring

A JWT token containing information identifying the end-user for whom authentication is being requested. One of 'login_hint_token', 'id_token_hint' or 'login_hint' MUST be specified.

login_hintstring

A hint to the OIDC Provider regarding the end-user for whom authentication is being requested. The value may contain an email address, phone number, account number, subject identifier, username, etc. One of 'login_hint_token', 'id_token_hint' or 'login_hint' MUST be specified.

binding_messagestring

A human-readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user.

user_codestring

A secret code, such as a password or pin, that is known only to the user but verifiable by the OIDC Provider.

requested_expirynumber

Integer value allowing the client to request the expires_in value for the auth_req_id the server will return.

client_idstring

OAuth2.0 client identifier. Required when the client authentication method is using "client_secret_post" or "tls_client_auth". It is optional when using "private_key_jwt" client authentication; when specified it MUST match the "client_assertion" subject.

client_secretstring

OAuth2.0 client secret. May be specified when using "client_secret_post" client authentication method.

client_assertionstring

The "private_key_jwt" assertion being used to authenticate the client.

client_assertion_type'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

Type of the client assertion.

Response

backchannel authentication response

auth_req_idstring required

A unique identifier to identify the authentication request made by the Client.

expires_innumber required

Integer value indicating the expiration time of the "auth_req_id" in seconds since the authentication request was received.

intervalnumber

Integer value indicating the minimum amount of time in seconds that the Client MUST wait between polling requests to the token endpoint.

Changes

No recorded changes to this operation across all 1 revision of this API.