Financial-grade API: Client Initiated Backchannel Authentication Profile - Draft 0.2 (Draft Standard)
Type
Standard
Year
2019
Authors
Tonge, D., Heenan, J., Lodderstedt, T., Campbell, B.
Identifiers
Report #: OpenID CIBA ID 1
Abstract
The Financial-grade API Standard provides a profile for OAuth 2.0 suitable for use in financial services. The standard OAuth method for the client to send the resource owner to the authorization server is to use an HTTP redirect. Parts 1 and 2 of this specification support this interaction model and are suitable for use cases where the resource owner is interacting with the client on a device they control that has a web browser. There are however many use-cases for initiating payments where the resource owner is not interacting with the client in such a manner. For example, the resource owner may want to authorize a payment at a "point of sale" terminal at a shop or fuel station.
This document is a profile of the OpenID Connect Client Initiated Backchannel Authentication Flow [CIBA] that supports this decoupled interaction method. The CIBA spec allows a client that gains knowledge of an identifier for the user to obtain tokens from the authorization server. The user consent is given at the user's Authentication Device mediated by the authorization server. This document profiles the CIBA specification to bring it in line with the other FAPI parts and provides security recommendations for its use with APIs that require financial-grade security.
Although it is possible to code an OpenID Provider and Relying Party from first principles using this specification, the main audience for this specification is parties who already have a certified implementation of OpenID Connect and want to achieve a higher level of security. Implementors are encouraged to understand the security considerations contained in section 7.5 before embarking on a 'from scratch' implementation.
Links
Citation
Tonge, D., Heenan, J., Lodderstedt, T., Campbell, B., 2019. Financial-grade API: Client Initiated Backchannel Authentication Profile - Draft 0.2 (Draft Standard). OpenID.
