Provide RFC 8707 support in CIBA grant type. - #4166
Merged
thiva-k merged 1 commit intoJul 20, 2026
Merged
Conversation
ImalshaD
requested review from
DonOmalVindula,
ThaminduDilshan,
brionmario,
darshanasbg,
rajithacharith and
thiva-k
as code owners
July 20, 2026 10:04
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (25)
🚧 Files skipped from review as they are similar to previous changes (19)
📝 WalkthroughWalkthroughChangesCIBA now supports RFC 8707 resource indicators from initiation through polling and token issuance. Resource bindings are resolved, persisted, validated, and used for token audiences and scopes. API schemas, database stores, tests, documentation, and the Wayfinder sample were updated. CIBA Resource Binding
Wayfinder Sample Setup
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CIBAClient
participant CIBAHandler
participant CIBAService
participant ResourceService
participant RequestStore
participant TokenClient
participant CIBAGrantHandler
participant AccessTokenBuilder
CIBAClient->>CIBAHandler: POST /oauth2/bc-authorize with resource
CIBAHandler->>CIBAService: InitiateBackchannelAuth(Resources)
CIBAService->>ResourceService: Resolve and downscope resource
CIBAService->>RequestStore: Persist CIBA request
TokenClient->>CIBAGrantHandler: Poll CIBA request
CIBAGrantHandler->>ResourceService: Validate stored resource binding
CIBAGrantHandler->>AccessTokenBuilder: Build resource-audience token
AccessTokenBuilder-->>TokenClient: Return access token
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)api/oauth2.yamlTraceback (most recent call last): 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ImalshaD
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds RFC 8707 Resource Indicator support to the OAuth2/OIDC CIBA (backchannel authentication) flow so CIBA requests can bind to a single resource server and receive resource-audience access tokens consistent with ThunderID’s single-resource-server audience model.
Changes:
- Adds resource parsing/validation at
/oauth2/bc-authorize, persists the effective resource binding, and enforces that token polling cannot widen/change the binding. - Issues CIBA access tokens with a single resource-server
aud(orclient_idfor unbound OIDC-only requests) and re-downscopes permission scopes against the bound resource server at issuance time. - Updates API contract + protocol docs and refreshes the Wayfinder sample configuration, with focused unit coverage across handler/service/store/token issuance.
Reviewed changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| samples/apps/wayfinder-sample/README.md | Updates local setup instructions for the sample (direct-auth secret handling, dev commands). |
| samples/apps/wayfinder-sample/backend/README.md | Aligns AuthZEN direct-auth secret documentation with file-backed secret usage. |
| samples/apps/wayfinder-sample/ai-agent/README.md | Updates run instructions to match the agent’s dev script. |
| samples/apps/wayfinder-sample/ai-agent/agent.ts | Adds resource to the sample’s CIBA initiation request to bind tokens to the MCP resource server. |
| docs/content/guides/key-concepts/authorization.mdx | Updates guidance to reflect that all access tokens (including CIBA) target a single resource server when bound. |
| docs/content/guides/guides/protocols/oauth-oidc/resource-indicators.mdx | Documents CIBA support and polling enforcement for resource indicators. |
| docs/content/guides/guides/protocols/oauth-oidc/backchannel-authentication.mdx | Documents CIBA resource-binding behavior and links to Resource Indicators guide. |
| backend/internal/oauth/oauth2/token/service_test.go | Adds unit coverage for propagating resource audience into refresh token issuance for CIBA. |
| backend/internal/oauth/oauth2/granthandlers/provider.go | Injects resource service dependency into the CIBA grant handler. |
| backend/internal/oauth/oauth2/granthandlers/ciba.go | Enforces polling resource consistency and issues resource-bound access tokens/scopes for CIBA. |
| backend/internal/oauth/oauth2/granthandlers/ciba_test.go | Adds/updates tests for bound vs unbound behavior, polling enforcement, and scope downscoping. |
| backend/internal/oauth/oauth2/ciba/store.go | Persists and retrieves the bound resource identifier(s) for CIBA auth requests in SQL-backed store. |
| backend/internal/oauth/oauth2/ciba/store_test.go | Adds SQL-store tests for resource encoding/decoding and empty round-trips. |
| backend/internal/oauth/oauth2/ciba/store_redis_test.go | Adds Redis-store test to ensure resources are preserved across Add/Get. |
| backend/internal/oauth/oauth2/ciba/store_constants.go | Extends CIBA_AUTH_REQUEST SQL queries to include the RESOURCES column. |
| backend/internal/oauth/oauth2/ciba/service.go | Resolves effective resource binding at initiation (explicit vs default), downscopes permissions, and stores the binding. |
| backend/internal/oauth/oauth2/ciba/service_test.go | Adds unit tests for resource resolution (explicit/default/none), rejection cases, and storage behavior. |
| backend/internal/oauth/oauth2/ciba/model.go | Adds Resources fields to CIBA request models for propagation/persistence. |
| backend/internal/oauth/oauth2/ciba/init.go | Wires server-config service into CIBA service initialization. |
| backend/internal/oauth/oauth2/ciba/handler.go | Parses repeated resource form parameters into the CIBA initiation request. |
| backend/internal/oauth/oauth2/ciba/handler_test.go | Adds handler tests ensuring single and repeated resource parameters are parsed/preserved. |
| backend/internal/oauth/init.go | Passes server-config service into CIBA initialization at the OAuth module level. |
| backend/dbscripts/runtime-transient/sqlite.sql | Adds RESOURCES column to the runtime-transient SQLite schema for CIBA requests. |
| backend/dbscripts/runtime-transient/postgres.sql | Adds RESOURCES column to the runtime-transient Postgres schema for CIBA requests. |
| api/oauth2.yaml | Adds /oauth2/bc-authorize endpoint to the published OAuth API contract and documents RFC 8707 behavior for CIBA. |
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
ImalshaD
force-pushed
the
ciba-rfc8707-resource-indicators
branch
from
July 20, 2026 10:33
2cee878 to
3895d6b
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/oauth2.yaml`:
- Around line 269-271: Update the TokenRequest schema to add
urn:openid:params:grant-type:ciba to grant_type.enum and add the required
auth_req_id string property with its CIBA-specific description. Preserve all
existing grant types and request fields.
- Around line 1145-1147: Update the requested_expiry schema property in the
relevant auth request definition from type string to type integer, preserving
its existing description and all other schema metadata.
- Around line 1109-1113: Update the BackchannelAuthRequest schema to include
client_id and client_secret in its properties, matching the corresponding
definitions and conventions used by TokenRequest so generated SDKs and API
documentation support form-based client authentication.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2053e99f-ae7d-4cc5-846b-aecf8ac91fa7
📒 Files selected for processing (25)
api/oauth2.yamlbackend/dbscripts/runtime-transient/postgres.sqlbackend/dbscripts/runtime-transient/sqlite.sqlbackend/internal/oauth/init.gobackend/internal/oauth/oauth2/ciba/handler.gobackend/internal/oauth/oauth2/ciba/handler_test.gobackend/internal/oauth/oauth2/ciba/init.gobackend/internal/oauth/oauth2/ciba/model.gobackend/internal/oauth/oauth2/ciba/service.gobackend/internal/oauth/oauth2/ciba/service_test.gobackend/internal/oauth/oauth2/ciba/store.gobackend/internal/oauth/oauth2/ciba/store_constants.gobackend/internal/oauth/oauth2/ciba/store_redis_test.gobackend/internal/oauth/oauth2/ciba/store_test.gobackend/internal/oauth/oauth2/granthandlers/ciba.gobackend/internal/oauth/oauth2/granthandlers/ciba_test.gobackend/internal/oauth/oauth2/granthandlers/provider.gobackend/internal/oauth/oauth2/token/service_test.godocs/content/guides/guides/protocols/oauth-oidc/backchannel-authentication.mdxdocs/content/guides/guides/protocols/oauth-oidc/resource-indicators.mdxdocs/content/guides/key-concepts/authorization.mdxsamples/apps/wayfinder-sample/README.mdsamples/apps/wayfinder-sample/ai-agent/README.mdsamples/apps/wayfinder-sample/ai-agent/agent.tssamples/apps/wayfinder-sample/backend/README.md
🚧 Files skipped from review as they are similar to previous changes (23)
- backend/dbscripts/runtime-transient/sqlite.sql
- samples/apps/wayfinder-sample/ai-agent/README.md
- backend/internal/oauth/oauth2/ciba/handler.go
- backend/dbscripts/runtime-transient/postgres.sql
- backend/internal/oauth/init.go
- backend/internal/oauth/oauth2/granthandlers/provider.go
- backend/internal/oauth/oauth2/ciba/model.go
- docs/content/guides/guides/protocols/oauth-oidc/backchannel-authentication.mdx
- samples/apps/wayfinder-sample/backend/README.md
- backend/internal/oauth/oauth2/ciba/store_test.go
- samples/apps/wayfinder-sample/ai-agent/agent.ts
- backend/internal/oauth/oauth2/ciba/store_redis_test.go
- backend/internal/oauth/oauth2/ciba/store_constants.go
- backend/internal/oauth/oauth2/ciba/store.go
- docs/content/guides/guides/protocols/oauth-oidc/resource-indicators.mdx
- docs/content/guides/key-concepts/authorization.mdx
- backend/internal/oauth/oauth2/ciba/init.go
- backend/internal/oauth/oauth2/ciba/handler_test.go
- samples/apps/wayfinder-sample/README.md
- backend/internal/oauth/oauth2/ciba/service.go
- backend/internal/oauth/oauth2/granthandlers/ciba_test.go
- backend/internal/oauth/oauth2/granthandlers/ciba.go
- backend/internal/oauth/oauth2/ciba/service_test.go
ImalshaD
force-pushed
the
ciba-rfc8707-resource-indicators
branch
from
July 20, 2026 11:31
3895d6b to
154c889
Compare
thiva-k
approved these changes
Jul 20, 2026
This was referenced Jul 21, 2026
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Add RFC 8707 Resource Indicator support to the OpenID Connect Client-Initiated Backchannel Authentication (CIBA) flow.
Previously, CIBA did not process or persist the resource parameter and issued access tokens with the OAuth client ID as the audience. This prevented CIBA requests from participating in Thunder’s single-resource-server audience model.
This change enables CIBA to:
Approach
The resource binding is selected at /oauth2/bc-authorize, before user authorization, because CIBA performs authorization before the client polls the token endpoint.
The implementation:
The Wayfinder CIBA upgrade flow was manually verified end to end:
Upgrade request
→ CIBA initiation with resource
→ Email approval
→ Token polling
→ Resource-bound CIBA token
→ process_upgrade
→ Business-class booking confirmed
Related Issues
Related PRs
Checklist
Security checks
(https://security.docs.wso2.com/en/latest/security-guidelines/secure-engineering-guidelines/secure-coding-guidlines/introduction/)
Summary by CodeRabbit
POST /oauth2/bc-authorize) to support optionalresourcebinding, including polling-time matching and resource-restricted access token audiences/permissions.npm run dev.