CIBA (Backchannel Authentication)

const AURIS_DOMAIN = 'https://auth.yourdomain.com'
const CLIENT_ID = 'your-client-id'
const CLIENT_SECRET = 'your-client-secret'
 
// Step 1: Initiate backchannel authentication
const cibaResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/ciba`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
  },
  body: new URLSearchParams({
    scope: 'openid profile',
    login_hint: '[email protected]',
    binding_message: 'Approve login to Dashboard',
  }),
}).then(r => r.json())
 
console.log('Auth request ID:', cibaResponse.auth_req_id)
console.log('User will receive a notification...')
 
// Step 2: Poll for the token
const token = await pollForCibaToken(cibaResponse)
 
async function pollForCibaToken(cibaResponse) {
  const interval = cibaResponse.interval * 1000
  const expiresAt = Date.now() + cibaResponse.expires_in * 1000
 
  while (Date.now() < expiresAt) {
    await new Promise(resolve => setTimeout(resolve, interval))
 
    const response = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
      },
      body: new URLSearchParams({
        grant_type: 'urn:openid:params:grant-type:ciba',
        auth_req_id: cibaResponse.auth_req_id,
      }),
    })
 
    if (response.ok) {
      return await response.json()
    }
 
    const error = await response.json()
 
    if (error.error === 'authorization_pending') continue
    if (error.error === 'slow_down') {
      await new Promise(r => setTimeout(r, 5000))
      continue
    }
    if (error.error === 'expired_token') {
      throw new Error('CIBA request expired. User did not respond in time.')
    }
    if (error.error === 'access_denied') {
      throw new Error('User denied the authentication request.')
    }
 
    throw new Error(`CIBA error: ${error.error}`)
  }
 
  throw new Error('CIBA request timed out.')
}

# Step 1: Initiate backchannel authentication
curl -X POST https://auth.yourdomain.com/api/oauth/ciba \
  -u "your-client-id:your-client-secret" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "scope=openid profile" \
  -d "[email protected]" \
  -d "binding_message=Approve login to Dashboard"
 
# Response:
# {
#   "auth_req_id": "1c266114-a1be-4252-8525-68e5427d093a",
#   "expires_in": 300,
#   "interval": 5
# }
 
# Step 2: Poll for the token (repeat every `interval` seconds)
curl -X POST https://auth.yourdomain.com/api/auth/token \
  -u "your-client-id:your-client-secret" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:openid:params:grant-type:ciba" \
  -d "auth_req_id=1c266114-a1be-4252-8525-68e5427d093a"
 
# Pending (HTTP 400):
# { "error": "authorization_pending" }
 
# Success (HTTP 200):
# {
#   "access_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "id_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g..."
# }

// Ping mode: Auris sends a POST to your callback URL when the user responds.
// Your server then exchanges the auth_req_id for a token.
 
// 1. Initiate (same as poll mode, but the application is configured for ping)
const cibaResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/ciba`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
  },
  body: new URLSearchParams({
    scope: 'openid profile',
    login_hint: '[email protected]',
    binding_message: 'Confirm payment of EUR 49.99',
  }),
}).then(r => r.json())
 
// 2. Auris sends a POST to your registered callback URL:
// POST https://your-app.com/ciba/callback
// Content-Type: application/json
// {
//   "auth_req_id": "1c266114-a1be-4252-8525-68e5427d093a"
// }
 
// 3. Your callback handler exchanges the auth_req_id for a token:
app.post('/ciba/callback', async (req, res) => {
  const { auth_req_id } = req.body
 
  const tokenResponse = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
    },
    body: new URLSearchParams({
      grant_type: 'urn:openid:params:grant-type:ciba',
      auth_req_id,
    }),
  })
 
  const token = await tokenResponse.json()
  // Process the authenticated session...
 
  res.status(200).json({ ok: true })
})