适用于无浏览器客户端的 OIDC

Question

I'm working on designing an OIDC Relying Party (SP), which should work with most of the popular OIDC Providers (IDPs). I requested to allow authentication and authorization also for clients that are not web applications. Is it recommended to work with OIDC in case there is no browser in the client? Which flow is the most recommended for this case? Are the most IDPs support such flow (with no browser)?

Answer 1

Many OpenID Connect providers use some form of " Device Flow "

This is one example https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/

Google for Device Flow and you can find many.

Answer 2

There's a draft specification for Client Initiated Backchanel Authentication (CIBA) flow ( https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html ).

This would work from a device which doesn't have a browser. Essentially the client makes an authentication request and the OpenID Provider (OP) authenticates using an Authentication Device (AD), usually a smartphone.

When the user is authenticated the client recieves the tokens either by poll, ping or push.

From the docs the flows look like this...

CIBA Poll Mode is illustrated in the following diagram:

    +--------+                                               +--------+
    |        |                                               |        |
    |        |<---(1) CIBA Request-------------------------->|        |
    |        |                                               |        |
    |        |  +--------+                                   |        |
    |        |  |        |                                   |        |
    | Client |  |   AD   |<--(2) User interactions---------->|   OP   |
    |        |  |        |                                   |        |
    |        |  +--------+                                   |        |
    |        |                                               |        |
    |        |----(3a) CIBA Polling Request----------------->|        |
    |        |<---(3b) CIBA Polling Response-----------------|        |
    |        |                ...                            |        |
    |        |----(3a) CIBA Polling Request----------------->|        |
    |        |<---(3b) CIBA Polling Response-----------------|        |
    |        |                                               |        |
    +--------+                                               +--------+

CIBA Ping Mode is illustrated in the following diagram:

    +--------+                                               +--------+
    |        |                                               |        |
    |        |<---(1) CIBA Request-------------------------->|        |
    |        |                                               |        |
    |        |  +--------+                                   |        |
    |        |  |        |                                   |        |
    | Client |  |  AD    |<--(2) User interactions---------->|   OP   |
    |        |  |        |                                   |        |
    |        |  +--------+                                   |        |
    |        |                                               |        |
    |        |<---(3) CIBA Ping Callback---------------------|        |
    |        |                                               |        |
    |        |----(4a) CIBA Token Request------------------->|        |
    |        |<---(4b) CIBA Token Response-------------------|        |
    +--------+                                               +--------+

CIBA Push Mode is illustrated in the following diagram:

    +--------+                                               +--------+
    |        |                                               |        |
    |        |<---(1) CIBA Request-------------------------->|        |
    |        |                                               |        |
    |        |  +--------+                                   |        |
    |        |  |        |                                   |        |
    | Client |  |  AD    |<--(2) User interactions---------->|   OP   |
    |        |  |        |                                   |        |
    |        |  +--------+                                   |        |
    |        |                                               |        |
    |        |<---(3) CIBA Push Callback---------------------|        |
    |        |                                               |        |
    +--------+                                               +--------+