[Federation] request authentication at other endpoints

Request authentication can be performed by means of the following, too.

CIBA (Client-Initiated Backchannel Authentication)

Client authentication methods at the backchannel authentication endpoint; The backchannel authentication endpoint always requires client authentication. (In other words, “public” clients cannot use CIBA.)
Request object passed to the backchannel authentication endpoint (CIBA Core Section 7.1.1); Use of request object is optional, but the FAPI-CIBA profile requires it.

Device Flow (RFC 8628)

Client authentication methods at the device authorization endpoint; Client authentication is required only when the client type is “confidential”.

The explanation and example about request_authentication_methods_supported in Section 4.2 OP Metadata of OpenID Connect Federation 1.0 should be updated to make sure that they don’t conflict with request authentication methods at the backchannel authentication endpoint and the device authorization endpoint listed above.

One concern is that the example value of request_authentication_methods_supported uses ar and par for the authorization endpoint and the pushed authorization request endpoint like below.

"request_authentication_methods_supported": {
    "ar": [
        "request_object"
    ],
    "par": [
        "private_key_jwt",
        "self_signed_tls_client_auth"
    ]
}

Because a rule on how to shorten endpoint names is not defined, sooner or later, we’ll have to discuss how to shorten names of “backchannel authentication endpoint” and “device authorization endpoint”.

Considering forward compatibility into account, official names (such as ones registered in the OAuth Authorization Server Metadata section in the IANA OAuth Parameters registry) should be used like below.

"request_authentication_methods_supported": {
    "authorization_endpoint": [
        "request_object"
    ],
    "pushed_authorization_request_endpoint": [
        "request_object",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "backchannel_authentication_endpoint": [
        "request_object",
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ],
    "device_authorization_endpoint": [
        "private_key_jwt",
        "tls_client_auth",
        "self_signed_tls_client_auth"
    ]
}

‌

Comments (7)