Create an IANA registry for parameters at the Client-Initiated Backchannel Authentication endpoint?

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2022-09-13

There isn’t currently an IANA registry for CIBA endpoint parameters like binding_message etc.

As we have people registering new parameters into that namespace there perhaps should be?

‌

e.g. https://www.ietf.org/archive/id/draft-ietf-oauth-rar-12.html#name-authorization-request

and probably in the future: https://bitbucket.org/openid/ekyc-ida/issues/1321/use-of-ekyc-ida-spec-with-ciba-fapi-ciba

---

Bitbucket status: new

Bitbucket origin: issue 209

[bitbucket-import-issues]

Originally submitted by Brian Campbell (Brian Campbell) on 2022-09-13

AFAIK an IANA registry isn’t something OIDF can do. So this might not be exactly simple to accomplish. Mike has some experience with this around the OP/AS metadata registry.

[bitbucket-import-issues]

Originally submitted by mbj (Michael Jones) on 2023-01-31

Only an RFC can create an IANA registry. There’s precedent for creating an RFC for creating registries for non-IETF working groups, such as https://www.rfc-editor.org/rfc/rfc8809.html. That said, there’s also plenty of extensible fields defined by OpenID specs, such as subject_types_supported, for which there is no registry. New values would simply be defined by new specifications. And that can be OK too.

I’d be glad to discuss this further.

[bitbucket-import-issues]

Originally submitted by Bjorn Hjelm (Bjorn Hjelm) on 2023-03-09

I’ll work on an RFC draft together with @{557058:8d4e94ec-77de-477e-971f-fbc78d08d0f7} using RFC 8809 as a template. If there’re additional RFC examples, that would be appreciated.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2023-06-06

What is the concrete example of the extension parameters?

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2023-06-07

Hi Nat

From memory, we have RAR which defines the authorization_details parameter for the CIBA endpoint, and there is a proposal somewhere to create a new spec that essentially imports the claims parameter from OIDC into CIBA

Having a central list of the CIBA parameters hence seemed sensible, but if you have other suggestions please do share them.

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2023-06-20

We also have the ekyc-ida spec that may/should/will define the verified_claims parameter for the CIBA endpoint.