CIBA (Backchannel Authentication)

const AURIS_DOMAIN = 'https://auth.tuodominio.com'
const CLIENT_ID = 'il-tuo-client-id'
const CLIENT_SECRET = 'il-tuo-client-secret'
 
// Passo 1: Avvia l'autenticazione backchannel
const cibaResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/ciba`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
  },
  body: new URLSearchParams({
    scope: 'openid profile',
    login_hint: '[email protected]',
    binding_message: 'Approva l\'accesso alla Dashboard',
  }),
}).then(r => r.json())
 
console.log('Auth request ID:', cibaResponse.auth_req_id)
console.log('L\'utente riceverà una notifica...')
 
// Passo 2: Fai polling per il token
const token = await pollForCibaToken(cibaResponse)
 
async function pollForCibaToken(cibaResponse) {
  const interval = cibaResponse.interval * 1000
  const expiresAt = Date.now() + cibaResponse.expires_in * 1000
 
  while (Date.now() < expiresAt) {
    await new Promise(resolve => setTimeout(resolve, interval))
 
    const response = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
      },
      body: new URLSearchParams({
        grant_type: 'urn:openid:params:grant-type:ciba',
        auth_req_id: cibaResponse.auth_req_id,
      }),
    })
 
    if (response.ok) {
      return await response.json()
    }
 
    const error = await response.json()
 
    if (error.error === 'authorization_pending') continue
    if (error.error === 'slow_down') {
      await new Promise(r => setTimeout(r, 5000))
      continue
    }
    if (error.error === 'expired_token') {
      throw new Error('Richiesta CIBA scaduta. L\'utente non ha risposto in tempo.')
    }
    if (error.error === 'access_denied') {
      throw new Error('L\'utente ha negato la richiesta di autenticazione.')
    }
 
    throw new Error(`Errore CIBA: ${error.error}`)
  }
 
  throw new Error('Richiesta CIBA scaduta.')
}

# Passo 1: Avvia l'autenticazione backchannel
curl -X POST https://auth.tuodominio.com/api/oauth/ciba \
  -u "il-tuo-client-id:il-tuo-client-secret" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "scope=openid profile" \
  -d "[email protected]" \
  -d "binding_message=Approva l'accesso alla Dashboard"
 
# Risposta:
# {
#   "auth_req_id": "1c266114-a1be-4252-8525-68e5427d093a",
#   "expires_in": 300,
#   "interval": 5
# }
 
# Passo 2: Polling per il token (ripeti ogni `interval` secondi)
curl -X POST https://auth.tuodominio.com/api/auth/token \
  -u "il-tuo-client-id:il-tuo-client-secret" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:openid:params:grant-type:ciba" \
  -d "auth_req_id=1c266114-a1be-4252-8525-68e5427d093a"
 
# In attesa (HTTP 400):
# { "error": "authorization_pending" }
 
# Successo (HTTP 200):
# {
#   "access_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "id_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g..."
# }

// Modalità Ping: Auris invia una POST al tuo callback URL quando l'utente risponde.
// Il tuo server scambia poi l'auth_req_id con un token.
 
// 1. Avvia (identico alla modalità poll, ma l'applicazione è configurata per ping)
const cibaResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/ciba`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
  },
  body: new URLSearchParams({
    scope: 'openid profile',
    login_hint: '[email protected]',
    binding_message: 'Conferma pagamento di EUR 49.99',
  }),
}).then(r => r.json())
 
// 2. Auris invia una POST al tuo callback URL registrato:
// POST https://tuaapp.com/ciba/callback
// Content-Type: application/json
// {
//   "auth_req_id": "1c266114-a1be-4252-8525-68e5427d093a"
// }
 
// 3. Il tuo handler del callback scambia l'auth_req_id con un token:
app.post('/ciba/callback', async (req, res) => {
  const { auth_req_id } = req.body
 
  const tokenResponse = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Basic ${btoa(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
    },
    body: new URLSearchParams({
      grant_type: 'urn:openid:params:grant-type:ciba',
      auth_req_id,
    }),
  })
 
  const token = await tokenResponse.json()
  // Elabora la sessione autenticata...
 
  res.status(200).json({ ok: true })
})