Client-Initiated Backchannel Authentication is an OpenID Connect flow in which the application asks the identity provider to authenticate a user out-of-band, rather than redirecting a browser. The user approves on their own device while the application polls or waits for a callback. It is the flow you need when the party being asked is not sitting in front of the session making the request.
CIBA
CIBA solves a problem redirect-based OAuth cannot: authorizing something that is happening somewhere else. A call centre agent verifying a customer, a payment initiated on a different device, or a network operator asking a subscriber to consent to their location being shared are all decoupled from any browser session.
- Decoupled by design - The consumption device and the authentication device are explicitly allowed to be different things.
- Poll, ping or push - The client can poll the token endpoint, be pinged to collect the token, or have it pushed, depending on the deployment.
- The basis of network-based authorization - CAMARA specifies CIBA for network authorization, because the subscriber whose SIM or location is in question is not the developer making the call.
- Advertised in discovery - A provider genuinely supporting it advertises the
urn:openid:params:grant-type:cibagrant and a backchannel authentication endpoint in its authorization-server metadata.
CIBA is where telecom’s standard-versus-implementation gap becomes concrete. The State of Telecom APIs found it present in three of nineteen standards and exposure repositories, absent from both specifications published by the one exposure platform with a callable CAMARA endpoint, and advertised in authorization-server metadata by exactly one company in the entire aggregator layer.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The State of Telecom APIs
The authorization flow CAMARA depends on: present in three of nineteen standards repositories, absent from both specifications of the one exposure platform with a callable CAMARA endpoint.
