FAPI CIBA and ID Tokens

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2019-06-12

We discussed on the call today whether we need ID Tokens in the FAPI profile of CIBA.

They are not needed as a detached signature and so perhaps we should remove the need for them.

The core spec leaves an option open for CIBA to be used without the openid scope, but it would require us to specify some behaviour that is currently inferred or defined in OpenID Connect core (e.g. id_token_hint, etc.)

---

Bitbucket status: open

Bitbucket origin: issue 229

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2019-06-19

{josephheenan} my suggestion with this one is to defer it to a later draft.

It think it would be quite a bit of work to remove the ID Token requirement now.

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2019-06-19

I can agree with that; I’ve tagged it as so, others are free to indicate their disagreement. Thanks Dave.

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2019-06-19

Agreed on call it was fine to defer this.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2022-12-14

Dave Tonge , perhaps we should address this ticket now?

CIBA Core requires “openid” scope.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2024-08-14

To be discussed.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2026-05-13

Suggest that this be closed - wontfix

[bitbucket-import-issues]

Originally submitted by Peter.Stanley (Peter.Stanley) on 2026-06-10

As per conversation on today's FAPI WF call - I am aware that TPPs have been asked for information about the level of Authentication performed by the ASPSP on transactions. This information is currently provided via the acr claim within the ID Token.

Initial thoughts: Supportive making ID Tokens an optional component as long as ability to return the acr claim (or equivalent) is maintained, either by the existing ID Token mechanism or some other process /component that is well defined.

For note: CIBA is not widely adopted in the UK at this time.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2026-06-17

Just to note, CIBA is a profile of OpenID Connect, so taking that out is not an option.
It sounds like a decoupled flow resembling the CIBA pattern is wanted, rather than CIBA.

Also, acr does not make sense without OpenID Connect or something that handles communication of authentication events. OAuth, per se, does not, and conflating them will likely cause security issues.