...
OpenID Connect CIBA (Client Initiated Backchannel Authentication) is a protocol specified in openid-client-initiated-backchannel-authentication-core-03 and is used for communication between Ubisecure SSO and SSO CIBA Adapter. an OpenID Provider (OP).
Ubisecure SSO has two authentication methods which conform to the CIBA specification, SPI OpenID Connect CIBA and Unregistered OpenID Connect CIBA, and can be used to integrate a qualified backchannel authentication service. The differences between the two methods are listed below.
...
The result of the installation described in this document is a working SPI OpenID Connect CIBA or Unregistered OpenID Connect CIBA authentication method.
...
Backchannel Authentication Flow
The picture below shows the authentication sequence, in which the authentication starts from a user agent, which sends an authentication request to SSO, which then initiates the authentication with the CIBA adapter sending the OpenID Provider (OP) handling backchannel authentication request.
- SSO sends backchannel authentication request to the CIBA adapterOP.
- CIBA adapter OP sends Authentication Request to a 3rd party Authentication Provider.
- The 3rd party AP handles the authentication by pushing an authentication request to the user's mobile device.
- After the authentication is successful, the 3rd party AP returns the Authentication Response.
- SSO receives id_token as Token Response for the latest Token Request.
- Note that while the authentication request was being processed during steps 2 to 5, SSO Server kept polling the CIBA adapter OP for the authentication status and received status authentication_pending until now.
- SSO responds with the authentication result.
| Gliffy | ||||||||
|---|---|---|---|---|---|---|---|---|
|
...
|
System requirements
- SPI OpenID Connect CIBA
- Ubisecure SSO 8.8 or later
- Unregistered OpenID Connect CIBA
- Ubisecure SSO 8.3 or later
- Ubisecure CIBA Adapter
| Info |
|---|
Prior to SSO 8.8 the authentication method Unregistered OpenID Connect CIBA was known as Backchannel Authentication Adapter. |
Installation of the CIBA Adapter is not covered in this document. Also please note that Ubisecure SSO requires the CIBA adapter instance to be accessible from the SSO server instance, because the authentication is based on backchannel communication between the SSO and the CIBA Adapter.
Installation
|
Installation
This chapter goes through the installation process for OpenID Connect CIBA authentication methods in SSO Management UI.
...
For installation, you need to get the following from the CIBA adapterOpenID provider (OP):
- CIBA adapter OP Metadata
- Standard URL path is
/.well-known/openid-configuration, for examplehttps://ap.example.com:8443/ciba/.well-known/openid-configuration
- Standard URL path is
- CIBA adapter OP JWKS
- URL for this is advertised in
jwks_uriclaim in the Provider Metadata.
- URL for this is advertised in
- Client Identifier -
client_id
...
- Insert
client_idin the Client Identifier field. - Press the Update button.
- Upload the Authentication Adapter OpenID provider Metadata.
- Press the Upload button next to label "Provider Metadata:".
- Paste the Authentication Adapter OP Metadata JSON string in the field or upload the file containing it.
- Press OK.
- Upload the Authentication Adapter the OpenID provider JWKS.
- Press the Upload button next to label "Provider JWKS:".
- Paste the Authentication Adapter OPr JWKS string in the field or upload the file containing it.
- Press OK.
...
| Conf string | Description | Default |
|---|---|---|
polling.interval.default | Interval in seconds to wait between token endpoint polling if interval attribute is not provided in authentication response. | 5 |
polling.interval.increase | Number of seconds to increase token polling interval if slow_down error is received from adapterOP. | 5 |
polling.initial.delay | Number of seconds after which the first token request is sent after a successful authentication response. | 0 |
...