Topic

CIBA

2 posts about CIBA. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Auth0
Building Secure AI Agents with Microsoft Agent Framework and Auth0: Human-in-the-Loop Approval
The post details how to add secure human-in-the-loop approval to an AI expense agent built with Microsoft Agent Framework and Auth0, completing the four-part series that handles identity, authorization, and action. Because approval is a security-sensitive action requiring the same cryptographic rigor as any authentication event, the agent uses Client-Initiated Backchannel Authentication (CIBA) to push a notification to the manager’s phone instead of accepting chat input. The notification includes a binding message describing the expense by ID, amount, vendor, and context, giving the manager enough information to decide from a lock screen. The agent polls Auth0’s token endpoint until the manager approves or denies, then uses the CIBA-issued access token scoped with approve:expenses to record the decision on a separate Expense API. This design ensures approval decisions are cryptographically bound to the manager’s identity and verifiable by downstream services, completing the secure loop.

Okta
Introducing CIBA for Secure Transaction Verification
CIBA addresses identity verification when an application cannot use an interactive login on the consumption device, including bank customer-service changes, retail POS payments, browser-constrained devices, and shared kiosks. Client-Initiated Backchannel Authentication decouples authentication from the application: a client sends a back-channel request to an OAuth 2.0 authorization provider, while the user approves it on a separately enrolled phone or smartwatch. CIBA extends OpenID Connect with a grant type, discovery metadata, and poll, ping, and push token-delivery modes; in the described banking flow, the application receives a user-scoped token to update the email address. The approach improves least-privilege access and avoids exposing credentials on shared devices, but can enable MFA-fatigue-style attacks, should not be used same-device, and may warrant device code flow in some cases.

The best engineering reads, once a week.

Topic

2 posts about CIBA. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Auth0
Building Secure AI Agents with Microsoft Agent Framework and Auth0: Human-in-the-Loop Approval
The post details how to add secure human-in-the-loop approval to an AI expense agent built with Microsoft Agent Framework and Auth0, completing the four-part series that handles identity, authorization, and action. Because approval is a security-sensitive action requiring the same cryptographic rigor as any authentication event, the agent uses Client-Initiated Backchannel Authentication (CIBA) to push a notification to the manager’s phone instead of accepting chat input. The notification includes a binding message describing the expense by ID, amount, vendor, and context, giving the manager enough information to decide from a lock screen. The agent polls Auth0’s token endpoint until the manager approves or denies, then uses the CIBA-issued access token scoped with approve:expenses to record the decision on a separate Expense API. This design ensures approval decisions are cryptographically bound to the manager’s identity and verifiable by downstream services, completing the secure loop.

Okta
Introducing CIBA for Secure Transaction Verification
CIBA addresses identity verification when an application cannot use an interactive login on the consumption device, including bank customer-service changes, retail POS payments, browser-constrained devices, and shared kiosks. Client-Initiated Backchannel Authentication decouples authentication from the application: a client sends a back-channel request to an OAuth 2.0 authorization provider, while the user approves it on a separately enrolled phone or smartwatch. CIBA extends OpenID Connect with a grant type, discovery metadata, and poll, ping, and push token-delivery modes; in the described banking flow, the application receives a user-scoped token to update the email address. The approach improves least-privilege access and avoids exposing credentials on shared devices, but can enable MFA-fatigue-style attacks, should not be used same-device, and may warrant device code flow in some cases.

The best engineering reads, once a week.