Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document when FE flow is applicable with regards to involved devices #256

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Document when FE flow is applicable with regards to involved devices #256

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
235b570
Update CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Jan 31, 2025
c55cebf
Update CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Jan 31, 2025
b26eb5b
Update CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Jan 31, 2025
0572372
Update CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Jan 31, 2025
5813965
Update CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Jan 31, 2025
e0b5efe
Update documentation/CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Feb 12, 2025
cc4cfbe
Update documentation/CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Feb 12, 2025
c92703c
Update documentation/CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Feb 12, 2025
fd508c1
Update documentation/CAMARA-API-access-and-user-consent.md
Elisabeth-Ericsson Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion documentation/CAMARA-API-access-and-user-consent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ The Application on the Consumption Device must be able to handle browser redirec


#### CIBA flow (Backend flow)
The CIBA flow is applicable if the consumption device is equal to or different from the target device of the intented Network API call(s).
The CIBA flow is applicable if the Consumption Device is equal to or different from the Target Device of the intended CAMARA API call(s).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CIBA is necessary if Consumption Device and Authentication Device are different. If Consumption Device and Authentication Device are the same, then OIDC Authentication Code Flow SHOULD be used.

The API Provider MUST send a message to the authentication device, identified by login_hint, because otherwise there would be no authentication at all.

Note: In cases where personal data is processed by the API and users can exercise their rights through mechanisms such as opt-in and/or opt-out, the use of three-legged access tokens is mandatory. This ensures that the API remains in compliance with privacy regulations, upholding the principles of transparency and user-centric privacy-by-design.

User consent cannot be checked based on the login_hint value alone and without sending a message, because then CIBA would be a two-legged flow while according the the note above a three-legged flow is mandatory.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Relation between consumption device and authentication device:

CIBA is necessary if Consumption Device and Authentication Device are different. If Consumption Device and >Authentication Device are the same, then OIDC Authentication Code Flow SHOULD be used.

The API invoker cannot know whether consumption device and authentication device are different. The API invoker in general has no awareness at all about authentication devices. The API invoker only knows the target device and potentially also the consumption device. Who is the legal responsbile (authorization device) of the target device is only known to the backend - the telco operator.

The OIDC Authentication Code Flow protocol does not foresee to communicate whether the consumption device is the authentication device or not. It would be beneficial to get this information in the response, but this is not the case today.

CIBA flow:

User consent cannot be checked based on the login_hint value alone and without sending a message, because then >CIBA would be a two-legged flow while according the the note above a three-legged flow is mandatory.
Can you please clarify this statement ?
AFAIK CIBA transports the information about the target resource/target device in the login_hint, The consent check happens for the target resource specified in the login_hint, The API invoker does not have any knowlege about the consumption device in this context.


```mermaid
sequenceDiagram
Expand Down