Should all login_hint formats be supported by an implementation?

[trehman-gsma]

Problem description
Seeking clarification on the extent of format support that is required within CIBA.

The Security and Interoperability Profile currently has 3 login_hint formats:

• Is it mandatory for an API implementation to support all login_hint formats? For example, a SimSwap implementation may not find value in supporting ipport.

• If not mandatory, what is the expected response when an unsupported login_hint is passed in?

Expected action
Clarification in documentation.

[eric-murray]

Hi @trehman-gsma

I think we have to accept that not all implementations will be able to support all login_hint options. For example, Vodafone currently do not support operator tokens, so any API consumers using login_hint="operatortoken:..." gets a guaranteed error from us. More practically, not all of our markets currently support IP/port to MSISDN look-up, so we cannot accept login_hint="ipport:..." in some countries.

As for the error, that is unknown_user_id

[garciasolero]

I'm not sure that the unknown_user_id error is the most appropriate in this case, as it would not distinguish it from the scenario where a user does not belong to the operator, and the application could keep making requests with the same login_hint prefix indefinitely. In my opinion it would be better to return invalid_request.

[trehman-gsma]

During the last ICM meeting, I explained the background context of this issue (GSMA are in comms with operators interested in deploying a CIBA-based implementation). During the discussion, there was a question about why an Operator might not support IP-port. Here is the response I received when I passed along the question:

1. The consumer of an API may not know the IP address and port number of the mobile device as this is a CIBA flow which assumes that the Authentication Device is not the same as the client application is resident on, although it may be.

2. Assuming the API consume does know the ip and port number, then it requires that the mobile network operator can resolve the public mobile IP address to the MSISDN of the device that has that IP address assigned. This specific feature has to be enable on the mobile gateway and is also an overhead.

3. Using the ip address as a login hint is unique to network providers and is not generally used as a hint.