![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
「マイクロソフト系技術情報 Wiki」は、「Open棟梁Project」,「OSSコンソーシアム .NET開発基盤部会」によって運営されています。
CIBAは、シーバと読み「新たなユーザ認証体験」のベースとなりうるものらしい。
に分離することによりユーザー認証体験の可能性が広がる。
※ OpenID Foundation の MODRNA（マッダーヌァ） WG (mobile系 の WG)で策定。
MODRNA : Mobile Operator Discovery, Registration & autheNticAtion?.
CIBA Flow ユーザ（なんでもOK）だが、
基本的にConfidential Client(RP)を経由する。
フロントエンドからリーチしないConfidential Client(RP)経由のバックチャネルと言う事だろうか。
以下のようなユースケースがある。
CIBAのユースケースのポイントは、
違うコトであるもよう。
認可リクエストを行う人と、認可 or 拒否ボタンを押下する人が違う。
Clientの、事前のユーザー識別は必要になる。
フローを見ると、RedirectによるOAuthダンスではなく、OAuth 2.0 Device Flow風で、
デバイスへの通知にSMSではなく、スマホのプッシュ通知を使用している感じの仕様っポイ。
認証リクエストを受け付けて直ちにレスポンスする（以後、非同期的に処理）。
POST /bc-authorize HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded scope=openid%20email%20example-scope& client_notification_token=8d67dc78-7faa-4d41-aabd-67707b374255& binding_message=W4SCT& login_hint_token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
POST /bc-authorize HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded request=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
{
"iss": "s6BhdRkqt3",
"aud": "https://server.example.com",
"exp": 1537820086,
"iat": 1537819486,
"nbf": 1537818886,
"jti": "4LTCqACC2ESC5BWCnN3j58EnA",
"scope": "openid email example-scope",
"client_notification_token": "8d67dc78-7faa-4d41-aabd-67707b374255",
"binding_message": "W4SCT",
"login_hint_token": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
} HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
{
"auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
"expires_in": 3600,
"interval": 2
} Content-Type: application/json
{
"error": "unauthorized_client",
"error_description":
"The client 'client.example.org' is not allowed to use CIBA."
} Content-Type: application/json
{
"error": "invalid_client",
"error_description": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
} Content-Type: application/json
{
"error": "access_denied",
"error_description": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache
{
"error":"missing_user_code"
}
特定した認証対象ユーザのスマホにプッシュ通知を送信する。
PKCE認証などして、認可 or 拒否ボタン押下で、結果をIdP/STS（OP）に伝える（？）
POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW grant_type=urn%3Aopenid%3Aparams%3Agrant-type%3Aciba &auth_req_id=1c266114-a1be-4252-8ad1-04986c5b9ac1
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
{
"access_token": "G5kXH2wHvUra0sHlDy1iTkDJgsgUO1bN",
"token_type": "Bearer",
"refresh_token": "4bwc0ESC_IAhflf-ACC_vjD_ltc11ne-8gFPfA2Kx16",
"expires_in": 3600,
"id_token": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
} +--------+ +--------+
| | | |
| |<---(1) CIBA Request-------------------------->| |
| | | |
| | +--------+ | |
| | | | | |
| Client | | AD |<--(2) User interactions---------->| OP |
| | | | | |
| | +--------+ | |
| | | |
| |----(3a) CIBA Polling Request----------------->| |
| |<---(3b) CIBA Polling Response-----------------| |
| | ... | |
| |----(3a) CIBA Polling Request----------------->| |
| |<---(3b) CIBA Polling Response-----------------| |
| | | |
+--------+ +--------+ +--------+ +--------+
| | | |
| |<---(1) CIBA Request-------------------------->| |
| | | |
| | +--------+ | |
| | | | | |
| Client | | AD |<--(2) User interactions---------->| OP |
| | | | | |
| | +--------+ | |
| | | |
| |<---(3) CIBA Ping Callback---------------------| |
| | | |
| |----(4a) CIBA Token Request------------------->| |
| |<---(4b) CIBA Token Response-------------------| |
+--------+ +--------+ POST /cb HTTP/1.1
Host: client.example.com
Authorization: Bearer 8d67dc78-7faa-4d41-aabd-67707b374255
Content-Type: application/json
{
"auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1"
} POST /cb HTTP/1.1
Host: client.example.com
Authorization: Bearer 8d67dc78-7faa-4d41-aabd-67707b374255
Content-Type: application/json
{
"auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
"error": "access_denied" or "expired_token" or "transaction_failed",
"error_description": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
} +--------+ +--------+
| | | |
| |<---(1) CIBA Request-------------------------->| |
| | | |
| | +--------+ | |
| | | | | |
| Client | | AD |<--(2) User interactions---------->| OP |
| | | | | |
| | +--------+ | |
| | | |
| |<---(3) CIBA Push Callback---------------------| |
| | | |
+--------+ +--------+ POST /cb HTTP/1.1
Host: client.example.com
Authorization: Bearer 8d67dc78-7faa-4d41-aabd-67707b374255
Content-Type: application/json
{
"auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
"access_token": "G5kXH2wHvUra0sHlDy1iTkDJgsgUO1bN",
"token_type": "Bearer",
"refresh_token": "4bwc0ESC_IAhflf-ACC_vjD_ltc11ne-8gFPfA2Kx16",
"expires_in": 3600,
"id_token": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
} {
"iss": "https://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"email": "janedoe@example.com",
"exp": 1537819803,
"iat": 1537819503,
"at_hash": "Wt0kVFXMacqvnHeyU0001w",
"urn:openid:params:jwt:claim:rt_hash": "sHahCuSpXCRg5mkDDvvr4w",
"urn:openid:params:jwt:claim:auth_req_id":
"1c266114-a1be-4252-8ad1-04986c5b9ac1"
} POST /connect/register HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: server.example.com
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJ ...
{
"application_type": "web",
"client_name": "My Example",
"logo_uri": "https://client.example.org/logo.png",
"subject_type": "pairwise",
"token_endpoint_auth_method": "private_key_jwt",
"grant_types": ["urn:openid:params:grant-type:ciba"],
"backchannel_token_delivery_mode": "poll",
"jwks_uri": "https://client.example.org/my_public_keys.jwks",
"userinfo_encrypted_response_alg": "RSA1_5",
"userinfo_encrypted_response_enc": "A128CBC-HS256",
"contacts": ["ve7jtb@example.org", "mary@example.org"]
}Tags: :IT国際標準, :認証基盤, :クレームベース認証, :OAuth
