Process Backchannel Authentication Request
This API parses request parameters of a backchannel authentication request and returns necessary data for the authorization server implementation to process the backchannel authentication request further.
Path parameters
A service ID.
Request body
Parameters of a backchannel authentication request which are the request parameters that the backchannel authentication endpoint of the OpenID provider implementation received from the client application.
The value of parameters is the entire entity body (which is formatted in application/x-www-form-urlencoded) of the request from the client application.
The client ID extracted from Authorization header of the backchannel authentication request from the client application.
If the backchannel authentication endpoint of the OpenID provider implementation supports Basic Authentication as a means of client authentication, and the request from the client application contained its client ID in Authorization header, the value should be extracted and set to this parameter.
The client secret extracted from Authorization header of the backchannel authentication request from the client application.
If the backchannel authentication endpoint of the OpenID provider implementation supports Basic Authentication as a means of client authentication, and the request from the client application contained its client secret in Authorization header, the value should be extracted and set to this parameter.
The client certification used in the TLS connection between the client application and the backchannel authentication endpoint of the OpenID provider.
The client certificate path presented by the client during client authentication. Each element is a string in PEM format.
The value of the OAuth-Client-Attestation HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.
The value of the OAuth-Client-Attestation-PoP HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.
Response
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of action parameter.
The client ID of the client application that has made the backchannel authentication request.
The client ID alias of the client application that has made the backchannel authentication request.
true if the value of the client_id request parameter included in the backchannel authentication request is the client ID alias. false if the value is the original numeric client ID.
The name of the client application which has made the backchannel authentication request.
The names of the claims which were requested indirectly via some special scopes. See 5.4. Requesting Claims using Scope Values in OpenID Connect Core 1.0 for details.
The client notification token included in the backchannel authentication request.
The list of ACR values requested by the backchannel authentication request.
Basically, this property holds the value of the acr_values request parameter in the backchannel authentication request. However, because unsupported ACR values are dropped on Authlete side, if the acr_values request parameter contains unrecognized ACR values, the list returned by this property becomes different from the value of the acr_values request parameter.
The type of the hint for end-user identification which was included in the backchannel authentication request.
The value of the hint for end-user identification.
The value of the sub claim contained in the ID token hint included in the backchannel authentication request.
The binding message included in the backchannel authentication request.
The binding message included in the backchannel authentication request.
The flag which indicates whether a user code is required.
true when both the backchannel_user_code_parameter metadata of the client (= Client's bcUserCodeRequired property) and the backchannel_user_code_parameter_supported metadata of the service (= Service's backchannelUserCodeParameterSupported property) are true.
The requested expiry for the authentication request ID (auth_req_id).
The request context of the backchannel authentication request.
It is the value of the request_context claim in the signed authentication request and its format is JSON. request_context is a new claim added by the FAPI-CIBA profile.
The warnings raised during processing the backchannel authentication request.
The ticket which is necessary to call Authlete's /auth/token/fail API or /auth/token/issue API.
This parameter has a value only if the value of grant_type request parameter is password and the token request is valid.
The resources specified by the resource request parameters or by the resource property in the request object. If both are given, the values in the request object should be set. See "Resource Indicators for OAuth 2.0" for details.
The client authentication method that was performed.
The grant management action of the device authorization request.
The grant_management_action request parameter is defined in Grant Management for OAuth 2.0.
the value of the grant_id request parameter of the device authorization request.
The grant_id request parameter is defined in Grant Management for OAuth 2.0 , which is supported by Authlete 2.3 and newer versions.
The subject identifying the user who has given the grant identified by the grant_id request parameter of the device authorization request. Authlete 2.3 and newer versions support Grant Management for OAuth 2.0. An authorization request may contain a grant_id request parameter which is defined in the specification. If the value of the request parameter is valid, {@link #getGrantSubject()} will return the subject of the user who has given the grant to the client application. Authorization server implementations may use the value returned from {@link #getGrantSubject()} in order to determine the user to authenticate. The user your system will authenticate during the authorization process (or has already authenticated) may be different from the user of the grant. The first implementer's draft of "Grant Management for OAuth 2.0" does not mention anything about the case, so the behavior in the case is left to implementations. Authlete will not perform the grant management action when the subject passed to Authlete does not match the user of the grant.
The entity ID of the client.
Flag which indicates whether the entity ID of the client was used when the request for the access token was made.
The location of the client's metadata document that was used to resolve client metadata.
This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.
Flag indicating whether a metadata document was used to resolve client metadata for this request.
When true, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database.