The backchannel login endpoint enables applications to send an authentication request to a user’s phone (provided they have an app installed and have enrolled for Push Notification authentication using the Guardian SDK). It can be useful to authenticate users who are not physically present, such as users phoning a call center, or where the device being used does not have a screen, such as a shared bicycle or scooter.

resp, err := authAPI.CIBA.Initiate(context.Background(), ciba.Request{
		ClientID:     mgmtClientID,
		ClientSecret: mgmtClientSecret,
		Scope:        "openid",
		LoginHint: map[string]string{
			"format": "iss_sub",
			"iss":    "your-issuer-domain",
			"sub":    "auth0|user-id-here",
		},
		BindingMessage: "TEST-BINDING-MESSAGE",
	})

token, err := authAPI.OAuth.LoginWithGrant(context.Background(),
			"urn:openid:params:grant-type:ciba",
			url.Values{
				"auth_req_id":   []string{resp.AuthReqID},
				"client_id":     []string{clientID},
				"client_secret": []string{clientSecret},
			},
			oauth.IDTokenValidationOptions{})

🔧 Changes

1. Add CIBA as a new authentication type.
2. Configure the new endpoint request/response obejcts.
3. Add required test cases.

📚 References

🔬 Testing

Relevant test cases has been added and can be tested using:
make test-record FILTER=TestCIBA

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)