Server-initiated Authentication

[Torsten Lodderstedt]

The MODRNA WG will propose a reasonable mechanisms to perform authentication in cases, where no user agent is available and the authentication process needs to initiated via server 2 server communication. Use cases are for example user authentication in the context of a call center call. The idea is to introduce an extension to the token endpoint (TBD: new grant type or JWT bearer assertion), which is used in conjunction with the standard scope value “openid” and potentially other OIDC scope values and parameters to initiate the authentication. The authentication process is conducted out of band using the same mechanisms the ID gateway uses for the standard Mobile Connect/OpenID Connect authentication flow via browser redirect. To be considered: * callback/polling needed * RP potentially knows MSISDN or PPID and wants to enforce it (2nd factor authentication via Mobile Connect)

[Torsten Lodderstedt]

Gonzalo volunteered to lead the topic. Florian agreed to work on the topic as well.

Goal: draft by end of July

[Gonzalo Fernández]

First version of document here: https://bitbucket.org/openid/mobile/src/ea52fc326e2ad089653fb66f60f90fdeea7df048/draft-mobile-client-initiated-backchannel-authentication-01.xml?at=default&fileviewer=file-view-default

[Bjorn Hjelm]

Propose closed with the existence of CIBA specification (Implementer's Draft version).

[Bjorn Hjelm]

Closed. See MODRNA WG meeting (Sep. 6, 2017) notes.

[Gonzalo Fernández]

This issue has been agreed to be closed because there is already a spec. CIBA.