Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recommend signed authentication requests for CIBA #217

Merged
merged 2 commits into from
Nov 7, 2024
Merged

Recommend signed authentication requests for CIBA #217

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
18f14be
Recommend signed authentication requests for CIBA
eric-murray Oct 15, 2024
7d7856b
Merge branch 'camaraproject:main' into eric-murray-patch-2
eric-murray Oct 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions documentation/CAMARA-Security-Interoperability.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,8 @@ The parameters `binding_message`, `user_code`, and `requested_expiry` are curren

### Authentication Request

It is RECOMMENDED that signed authentication requests be used, as specified by [OIDC CIBA Core](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#signed_auth_request). The same key MAY be used for signing the authentication request as is used for [client authentication](#client-authentication).

CIBA allows the client to use login_hint_token, id_token_hint or login_hint as a hint in the authentication request. This CAMARA profile makes the login_hint parameter REQUIRED. The client SHALL specify login_hint (and only login_hint) in the authentication request when using CIBA in a CAMARA context.

The client MUST authenticate with the authorization server as described in [Client Authentication Section](#client-authentication).
Expand Down