#### [Abblix\.Oidc\.Server](https://www.abblix.com/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants')

## BackChannelAuthenticationGrantHandler Class

Handles the authorization process for backchannel authentication requests under the Client\-Initiated Backchannel
Authentication \(CIBA\) grant type\.
This handler validates the token request based on the backchannel authentication flow, ensuring
that the client is authorized and that the user has been authenticated before tokens are issued\.
Supports both short\-polling \(immediate response\) and long\-polling \(holds connection until auth completes\)\.

```csharp
public class BackChannelAuthenticationGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationGrantHandler

Implements [IAuthorizationGrantHandler](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer')
### Constructors

## BackChannelAuthenticationGrantHandler\(ILogger\<BackChannelAuthenticationGrantHandler\>, IBackChannelRequestStorage, IAuthorizationDetailsPolicy, TimeProvider, IOptions\<OidcOptions\>, IServiceProvider, ISubjectTypeConverter, IBackChannelLongPollingService\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService)}

Handles the authorization process for backchannel authentication requests under the Client\-Initiated Backchannel
Authentication \(CIBA\) grant type\.
This handler validates the token request based on the backchannel authentication flow, ensuring
that the client is authorized and that the user has been authenticated before tokens are issued\.
Supports both short\-polling \(immediate response\) and long\-polling \(holds connection until auth completes\)\.

```csharp
public BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler> logger, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options, System.IServiceProvider serviceProvider, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService? statusNotifier=null);
```
#### Parameters

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[BackChannelAuthenticationGrantHandler](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.BackChannelAuthenticationGrantHandler')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).logger}

Records a refusal the client is deliberately told nothing specific about\.

###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).storage}

Service for storing and retrieving backchannel authentication requests\.

###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).authorizationDetailsPolicy}

Asks the per\-type validators whether the grant's
            authorization\_details are still acceptable, which is the only comparison that can see inside an
            entry\.

###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).timeProvider}

Provides access to the current time\.

###### `options` [Microsoft\.Extensions\.Options\.IOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).options}

Configuration options for backchannel authentication including long\-polling settings\.

###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).serviceProvider}

Service provider for resolving mode\-specific grant processors\.

###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).subjectTypeConverter}

Seals the authenticated session's subject the way the requesting client sees it, so it can be compared
against the end user the original request named\.

###### `statusNotifier` [IBackChannelLongPollingService](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).statusNotifier}

Notifier for long\-polling status changes \(null if long\-polling disabled\)\.
### Properties

## BackChannelAuthenticationGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.GrantTypesSupported}

Specifies the grant types supported by this handler, specifically the "CIBA" \(Client\-Initiated Backchannel
Authentication\) grant type\.
This property ensures that the handler is only invoked for the specific grant type it supports\.

```csharp
public System.Collections.Generic.IEnumerable<string> GrantTypesSupported { get; }
```

Implements [GrantTypesSupported](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported')

#### Property Value
[System\.Collections\.Generic\.IEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')
### Methods

## BackChannelAuthenticationGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)}

Processes the authorization request by verifying the authentication request ID and checking the status of the
associated backchannel authentication request\. Supports both short\-polling \(immediate response\) and optional
long\-polling \(holds connection until authentication completes or timeout\)\.

```csharp
public System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Common.OidcError>> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `request` [TokenRequest](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request}

The token request containing the authentication request ID and other parameters\.

###### `clientInfo` [ClientInfo](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo}

Information about the client making the request, used to validate client identity
            and determine token delivery mode \(poll/ping/push\)\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken}

Abandons the operation when the caller stops waiting\.

Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result&lt;](https://www.abblix.com/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[&gt;](https://www.abblix.com/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
Either an authorized grant if authentication succeeded, or an error indicating why the request failed
\(authorization\_pending, access\_denied, expired\_token, slow\_down, or invalid\_grant\)\.

### Remarks

<strong>Behavior by Authentication Status:</strong>
- Authenticated:
- Pending (short-polling):
- Pending (long-polling):
- Denied:
- Expired/Not Found:
- Rate Limited:

Long-polling reduces latency (0-1s vs 0-5s) and server load (1-4 req/min vs 12 req/min) by holding the
connection open until authentication completes instead of requiring repeated polling.