Contactless or Cashless Transactions in the World of “ New Normal"
By: Vivek Vinushanth Christopher
Tags: Ciba, Identity Management, Computer Science, Open Source, Open Banking

2.3 CIBA Authentication Flow — Poll Mode

Now, with the basic understanding of the endpoints, authentication flow, and the token request modes, taking POLL Mode as an example lets have a deep understanding of important steps.

2.3.1 The Authentication Request

Authentication Request is initiated by the client (And that’s why it is Client-Initiated Back-channel Authentication). The client needs to inform the authorization server about for whom it is requesting the authentication. So it is mandatory that there should be some user identity from the Consumption device for which it can request, Access, and ID token. There are three ways for a consumption device to add user identity. login_hint,login_hint_token, id_token_hint can be a used. login_hint is a hint to the Authorization server about the user for whom the Authentication flow is initiated. The value may be an email address, phone number, account number, username, etc., which identifies the end-user to the OP. The value may be directly collected from the user by the Client just before the CIBA Authentication request or can be obtained in other ways. login_hint is simple to understand and implement though login_hint_token and id_token_hint can provide improved security. login_hint_token is a token with user details and id_token_hint is sending a previously received ID Token as a hint. Do not worry if you don't understand it deeply. Just consider these hints provide information about the user to the Authorization Server.

Scope is a required parameter. “openID” is the mandatory value (Eg. { “Scope” : “openid%20email%20example-scope”}). ACR values is an optional parameter. Acr stands for Authentication Context Class Reference. Indicate whether authentication happens successfully or not. If '0' - Did not meet the authentication requirements successfully. Highly recommended that if the request has this, let the response has this too. User-code too is an optional parameter which is a pin/password only known for the end-user which is used to authorize the Authentication Request preventing random clients or users initiate authentication requests for the legitimate user who is unaware and has to deny the access. The binding_message, an optional parameter is a human-readable message displayed on both Authentication and Consumption devices to interlock. Requested expiry an optional parameter is a positive integer value that allows the client to request 'expires_in' value for auth_req_id.

POST http://localhost:8080/CIBAEndPoint HTTP/1.1

Host:http://localhost:8080

Content-Type: application/x-www-form-urlencoded

Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW{

"scope" : "openid%20email%20example-scope"

"binding_message: "W4SCT"

"login_hint":"A@examplebank.com"

}

The CIBA specification recommends signed authentication requests which can be sent as the request parameter. And for simplicity, we will not be going through them here. You can check this blog for more details.

2.3.2 Authentication Response

Once the request is successfully validated, the Authorization server responds with “200 OK” indicating that the authorization request has been accepted. And Authorization server sends an Authorization response. If failed invalidation, the response message is sent with error_message and error_code. We can see them later in detail. auth_req_id is a required parameter. It has to be a unique identifier for the Authentication request made. expires_in is also a mandated parameter. It is a positive long value representing seconds. It marks the expiry time of auth_req_id. And if the auth_req_id expired, has to respond with an error response. Interval is an optional parameter. It is mandatory only for ping/poll token request modes. It is a positive long value representing seconds which denotes the polling frequency.

HTTP/1.1 200 OK

Content-Type: application/json

Cache-Control: no-store{

"auth_req_id”:”702552be-f0ef-4ca0–9f66-c766e9525e63",

”interval”:2,

”expires_in”:3600

}

2.3.3 Communication

Now OP(OpenId provider-Authorization server) communicates with the end-user. This communication step is out of the scope of the specification of CIBA. We need to choose a better option to implement.

2.3.4 Token Request

For Ping one it receives Authentication device requests for Token with confirmation with the reception of correct auth_req_id back to the Authentication device. For Push, the Token is sent once the Authorization server receives the provision of consent and credentials. For Poll Token mode Authentication device can continue to poll for a token once it receives Authentication response with auth_req_id and poll till it expires(will result in an error if it tries to poll again once it receives token). grant_type is a mandatory parameter and the value should be openid:params:grant-type:ciba . auth_req_id is a mandatory parameter that is used to validate the request.

2.3.5 Token Response

Token response too, common for ping and poll. Token Response usually adds an access token, ID token, and optionally a refresh token. It also includes expires_in parameter to mark the expiry time of the token provided.