Contents

Introduction

OpenID Connect CIBA (Client Initiated Backchannel Authentication) is a protocol specified in openid-client-initiated-backchannel-authentication-core-03 and is used for communication between Ubisecure SSO and an OpenID Provider (OP).

Ubisecure SSO has two authentication methods which conform to the CIBA specification, SPI OpenID Connect CIBA and Unregistered OpenID Connect CIBA, and can be used to integrate a qualified backchannel authentication service. The differences between the two methods are listed below.

SPI OpenID Connect CIBA

Step-up method (requires a password method as the first factor authentication method).
Generates directory identities
The login_hint sent in the backchannel authentication request is read from a user directory attribute.

Unregistered OpenID Connect CIBA

Unregistered method
Generates unregistered identities
The login_hint sent in the backchannel authentication request is entered by the end-user in the SSO login page.

This documentation describes the requirements and tasks for installing and configuring SPI OpenID Connect CIBA and Unregistered OpenID Connect CIBA authentication methods in Ubisecure SSO.

The result of the installation described in this document is a working SPI OpenID Connect CIBA or Unregistered OpenID Connect CIBA authentication method.

Backchannel Authentication Flow

The picture below shows the authentication sequence, in which the authentication starts from a user agent, which sends an authentication request to SSO, which then initiates the authentication with the OpenID Provider (OP) handling backchannel authentication request.

SSO sends backchannel authentication request to the OP.
OP sends Authentication Request to a 3rd party Authentication Provider.
The 3rd party AP handles the authentication by pushing an authentication request to the user's mobile device.
After the authentication is successful, the 3rd party AP returns the Authentication Response.
SSO receives id_token as Token Response for the latest Token Request.
1. Note that while the authentication request was being processed during steps 2 to 5, SSO Server kept polling OP for the authentication status and received status authentication_pending until now.
SSO responds with the authentication result.

Installation

This chapter goes through the installation process for OpenID Connect CIBA authentication methods in SSO Management UI.

Preparation

For installation, you need to get the following from the OpenID Provider (OP):

OP Metadata
- Standard URL path is /.well-known/openid-configuration
OP JWKS
- URL for this is advertised in jwks_uri claim in the OP Metadata
Client Identifier - client_id

Creating the Authentication Method

Unregistered OpenID Connect CIBA

Create a new Authentication Method in the Authentication methods page and select OpenID Connect CIBA as the Method Type.

Continue with the instructions under Both.

SPI OpenID Connect CIBA

Select which password method should be the first-factor and see which directory service it uses. Verify that the directory service has a conf string password-name set as shown below, where password.x is the name of the first-factor password method.

password-name=password.x

If the directory service already has password-name set, but its value is something else than the name of the first-factor password method, then you can also set it in the SPI OpenID Connect CIBA method after it's been created.

The value of password-name in the authentication method will override the value in the directory service.

Create a new Authentication Method in the Authentication methods page, select SPI OpenID Connect CIBA as the Method Type and select the directory service to be same as the one in the first-factor password method.

Continue with the instructions under Both.

Both OpenID Connect CIBA methods

After finishing you should end up in the method's configuration page. You can go there by clicking the method in the list.

Under the SPI OpenID Connect CIBA or Unregistered OpenID Connect CIBA tab:

Insert client_id in the Client Identifier field
Press the Update button
Upload the OP Metadata
1. Press the Upload button next to label "Provider Metadata:"
2. Paste the OP Metadata JSON string in the field or upload the file containing it
3. Press OK
Upload the OP JWKS
1. Press the Upload button next to label "Provider JWKS:"
2. Paste the OP JWKS string in the field or upload the file containing it
3. Press OK

Under the Main tab:

Tick Enabled
Press the Update button

Configuration

These configuration options are available to be added to "Configuration String" in method settings.

Both OpenID Connect CIBA methods

Conf string	Description	Default
`polling.interval.default`	Interval in seconds to wait between token endpoint polling if interval attribute is not provided in authentication response.	`5`
`polling.interval.increase`	Number of seconds to increase token polling interval if `slow_down` error is received from OP.	`5`
`polling.initial.delay`	Number of seconds after which the first token request is sent after a successful authentication response.	`0`

SPI OpenID Connect CIBA

Conf string	Description	Default
directory.mobile.attribute	Name of the user directory attribute used for storing the mobile phone number of the user.	`mobile`
directory.ciba.attribute	Name of the user directory attribute which must match the id_token claim defined in `accountAttributeClaim`.	`[directory.mobile.attribute]`
directory.ciba.loginHint	Name of the user directory attribute whose value is sent as `login_hint` parameter in the authentication request.	`[directory.ciba.attribute]`
`accountAttributeClaim`	Name of the id_token claim which must match the user directory attribute defined in `directory.ciba.attribute`.	`sub`

Unregistered OpenID Connect CIBA

Conf string	Description	Default
`usernameClaim`	Name of the id_token claim which is used as the subject of the unregistered identity.	`sub`

Browser not supported