@Path("/api/backchannel/authentication")
public class BackchannelAuthenticationEndpoint
{
    /**
     * Backchanel Authentication Endpoint
     * The endpoint accepts a request with POST and application/x-www-form-urlencoded.
     * Also, in this artichle, we explain the case of the client_secret_basic only.
     *
     * @param authorization
     *         The value of Authorization header in the backchannel authentication request.
     *
     * @param parameters
     *         Request parameters of a backchannel authentication request.
     */
    @POST
    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
    public Response post(@HeaderParam(HttpHeaders.AUTHORIZATION) String authorization, MultivaluedMap<String, String> parameters)
    {
        try
        {
            // main process
            return doProcess(authorization, parameters);
        }
        catch (WebApplicationException e)
        {
            // known errors
            return e.getResponse();
        }
        catch (Throwable t)
        {
            // unknown errors
            return ResponseUtil.internalServerError("Unknown error occurred.");
        }
    }

    private Response doProcess(String authorization, MultivaluedMap<String, String> parameters)
    {
        // main process implementation
    }
}

private Response doProcess(String authorization, MultivaluedMap<String, String> parameters)
{
    // Parse the Authorization header and extract client credentials.
    BasicCredentials credentials = BasicCredentials.parse(authorization);

    // Extract the client ID and the client secret from the client credentials.
    String clientId     = credentials == null ? null : credentials.getUserId();
    String clientSecret = credentials == null ? null : credentials.getPassword();

    // Call Authlete's /api/backchannel/authentication API to delegate the
    // verification process of the request to Authlete.
    BackchannelAuthenticationResponse response =
        callBackchannelAuthenticationApi(parameters, clientId, clientSecret);

    // The 'action' parameter in the response denotes the next action that
    // this authorization server should take.
    BackchannelAuthenticationResponse.Action action = response.getAction();

    // The content of the response that should be returned to the client.
    // The content varies depending on the 'action'.
    String content = response.getResponseContent();

    // Process according to the 'action'.
    switch (action)
    {
        case INTERNAL_SERVER_ERROR:
            // The API call was wrong or an error occurred on Authlete side.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError(content);

        case UNAUTHORIZED:
            // The client authentication failed. For example, the client ID was wrong.
            // 401 Unauthorized
            return ResponseUtil.unauthorized(content, "Basic realm=\"backchannel/authentication\"");

        case BAD_REQUEST:
            // The request was wrong. For example, mandatory request parameters are not included.
            // 400 Bad Request
            return ResponseUtil.badRequest(content);

        case USER_IDENTIFICATION:
            // The request is valid. In this case, handleUserIdentification() handles
            // the remaining steps.
            return handleUserIdentification(response);

        default:
            // Other cases. This should not happen.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError("Unknown action returned from /api/backchannel/authentication API.");
    }
}

private Response handleUserIdentification(BackchannelAuthenticationResponse baRes)
{
    // Identify the end-user using the hint included in the request.
    User user = identifyUserByHint(baRes);
}

private User identifyUserByHint(BackchannelAuthenticationResponse baRes)
{
    // The type of the hint included in the request. The value is
    // either LOGIN_HINT, LOGIN_HINT_TOKEN, or ID_TOKEN_HINT.
    UserIdentificationHintType hintType = baRes.getHintType();

    // The hint included in the request.
    String hint = baRes.getHint();

    // Find the end-user using the hint.
    User user = getUserByHint(hintType, hint);

    if (user != null)
    {
        // The end-user was found.
        return user;
    }

    // No end-user was found with the hint. In this case, call Authlete's
    // /api/backchannel/authentication/fail API in order to generate an
    // appropriate response and throw it as an exception. Note that the
    // exception will be caught by the post() method.
    throw backchannelAuthenticationFail(baRes.getTicket(), Reason.UNKNOWN_USER_ID);
}

private User getUserByHint(UserIdentificationHintType hintType, String hint)
{
    if (hintType != UserIdentificationHintType.LOGIN_HINT)
    {
        // This implementation supports login_hint only, so other hint
        // types are ignored.
        return null;
    }

    // Find the end-user using the login_hint. The implementation below
    // assumes that either an end-user's subject, email address or phone
    // number is used as the value of the login_hint parameter.

    // First, look up the end-user assuming that the login_hint is an
    // end-user's subject.
    User user = UserDao.getBySubject(hint);

    if (user != null)
    {
        // The end-user was found.
        return user;
    }

    // Next, assume the login_hint is an end-user's email address.
    user = UserDao.getByEmail(hint);

    if (user != null)
    {
        // The end-user was found.
        return user;
    }

    // Finally, assume the login_hint is an end-user's phone number.
    return UserDao.getByPhoneNumber(hint);
}

private WebApplicationException backchannelAuthenticationFail(String ticket, BackchannelAuthenticationFailRequest.Reason reason)
{
    // Call Authlete's /api/backchannel/authentication API to generate an
    // appropriate response.
    Response response = createBackchannelAuthenticationFailResponse(ticket, reason);

    // Generate an exception that respresents the response.
    return new WebApplicationException(response);
}

private Response createBackchannelAuthenticationFailResponse(String ticket, BackchannelAuthenticationFailRequest.Reason reason)
{
    // Call Authlete's /api/backchannel/authentication/fail API.
    BackchannelAuthenticationFailResponse response = callBackchannelAuthenticationFail(ticket, reason);

    // The 'action' parameter in the response denotes the next action that
    // this authorization server should take.
    BackchannelAuthenticationFailResponse.Action action = response.getAction();

    // The content of the response that should be returned to the client.
    // The content varies depending on the 'action'.
    String content = response.getResponseContent();

    // Process according to the 'action'.
    switch (action)
    {
        case INTERNAL_SERVER_ERROR:
            // 500 Internal Server Error
            return ResponseUtil.internalServerError(content);

        case FORBIDDEN:
            // 403 Forbidden
            return ResponseUtil.forbidden(content);

        case BAD_REQUEST:
            // 400 Bad Request
            return ResponseUtil.badRequest(content);

        default:
            // Other cases. This should not happen.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError("Unknown action returned from /api/backchannel/authentication/fail.");
    }
}

if (service.isBackchannelUserCodeParameterSupported() && client.isBcUserCodeRequired())
{
    if (isUserCodeContainedInRequestParameters() == false)
    {
        // returns an error response with action=BAD_REQUEST to the requesting authorization server
        throw missingUserCodeError();
    }
}

private Response handleUserIdentification(BackchannelAuthenticationResponse baRes)
{
    ...

    // Check the user code.
    checkUserCode(baRes, user);
}

private void checkUserCode(BackchannelAuthenticationResponse baRes, User user)
{
    // If a user code is not mandatory (= not Case 1)
    //
    // Note that isUserCodeRequired() method returns true when both the
    // backchannelUserCodeParameterSupported metadata of the service (the
    // authorization server) and the bcUserCodeRequired metadata of the
    // client are true. In other cases, the method returns false.
    if (baRes.isUserCodeRequired() == false)
    {
        // Nothing is checked here.
        return;
    }

    // The value of the user_code in the request.
    String userCodeInRequest = baRes.getUserCode();

    // The valid user code.
    String userCode = user.getCode();

    // If they match.
    if (userCodeInRequest.equals(userCode))
    {
        // The request includes the valid user code.
        return;
    }

    // The user code included in the request is wrong. In this case,
    // call Authlete's /api/backchannel/authentication/fail API in
    // order to generate an appropriate response and then throw it
    // as an exception. Note that the exception will be caught by
    // the post() method later.
    throw backchannelAuthenticationFail(baRes.getTicket(), Reason.INVALID_USER_CODE);
}

/**
 * The maximum number of characters in a binding message.
 */
private static String MAX_BINDING_MESSAGE_LENGTH = 100;

...

private Response handleUserIdentification(BackchannelAuthenticationResponse baRes)
{
    ...

    // Check the binding message.
    checkBindingMessage(baRes);
}

private void checkBindingMessage(BackchannelAuthenticationResponse baRes)
{
    // The binding message included in the request.
    String bindingMessage = baRes.getBindingMessage();

    // If no binding message is available.
    if (bindingMessage == null || bindingMessage.length() == 0)
    {
        // Nothing is checked here.
        return;
    }

    // If the length of the binding message exceeeds the upper limit.
    if (bindingMessage.length() > MAX_BINDING_MESSAGE_LENGTH)
    {
        // The request includes an invalid binding message (whose length
        // exceeds the upper limit). In this case, call Authlete's
        // /api/backchannel/authentication/fail API in order to generate
        // an appropriate response and throw it as an exception. Note
        // that the exception will be caught later by the post() method.
        throw backchannelAuthenticationFail(baRes.getTicket(), Reason.INVALID_BINDING_MESSAGE);
    }
}

private Response handleUserIdentification(BackchannelAuthenticationResponse baRes)
{
    ...

    // Issue an auth_req_id.
    return issueAuthReqId(baRes);
}

private Response issueAuthReqId(BackchannelAuthenticationResponse baRes)
{
    // Call Authlete's /api/backchannel/authentication/issue API.
    // The API issues an 'auth_req_id'.
    BackchannelAuthenticationIssueResponse baiRes = callBackchannelAuthenticationIssue(baRes.getTicket());

    // The 'action' parameter in the response denotes the next action
    // that this authorization server should take.
    BackchannelAuthenticationIssueResponse.Action action = baiRes.getAction();

    // The content of the response that should be returned to the client.
    // The content varies depending on the 'action'.
    String content = baiRes.getResponseContent();

    // Process according to the 'action'.
    switch (action)
    {
        case INTERNAL_SERVER_ERROR:
            // The API call was wrong or an error occurred on Authlete side.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError(content);

        case INVALID_TICKET:
            // The ticket included in the API call was invalid.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError(content);

        case OK:
            // Start a background process.
            startCommunicationWithAuthenticationDevice(user, baRes);

            // 200 OK with an 'auth_req_id'.
            return ResponseUtil.ok(content);

        default:
            // Other cases. This should not happen.
            // 500 Internal Server Error
            return ResponseUtil.internalServerError("Unknown action returned from /api/backchannel/authentication/issue API.");
    }
}

private void startCommunicationWithAuthenticationDevice(User user, BackchannelAuthenticationResponse info)
{
    // The ticket which is necessary to call Authlete's
    // /api/backchannel/authentication/complete API after the communication
    // with the authentication device is done.
    final String ticket = info.getTicket();

    // The name of the client.
    final String clientName = info.getClientName();

    // The scopes requested by the client.
    final Scope[] scopes = info.getScopes();

    // The claims requested by the client.
    final String[] claimNames = info.getClaimNames();

    // The binding message which will be displayed on the authentication device.
    final String bindingMessage = info.getBindingMessage();

    // Start a background process.
    Executors.newSingleThreadExecutor().execute(new Runnable() {
        try
        {
            // The main part of the background process.
            doInBackground(ticket, user, clientName, scopes, claimNames, bindingMessage);
        }
        catch (WebApplicationException e)
        {
            // Log the error.
            Logger.log(e);
        }
        catch (Throwable t)
        {
            // Log the error.
            Logger.log(t);
        }
    });
}

private void doInBackground(String ticket, User user, String clientName, Scope[] scopes, String[] claimNames, String bindingMessage)
{
    // A response from the authentication device.
    MyAuthenticationDeviceResponse response;

    try
    {
        // Communicate with the authentication device.
        response = communicateWithMyAuthenticationDevice(user.getSubject(), buildMessage());
    }
    catch (Throwable t)
    {
        // An error occurred during communication with the authentication device.
        // In this case, call Authlete's /api/backchannel/authentication/complete
        // API with result=TRANSACTION_FAILED.
        completeWithTransactionFailed(ticket, user);
        return;
    }

    // The decision made by the end-user on the authentication device
    // (= whether the end-user has authorized the request from the client).
    MyAuthenticationDeviceResult result = response.getResult();

    if (result == null)
    {
        // The result is empty. This should not happen. In this case,
        // call Authlete's /api/backchannel/authentication/complete API
        // with result=TRANSACTION_FAILED.
        completeWithTransactionFailed(ticket, user);
        return;
    }

    switch (result)
    {
        case allow:
            // When the end-user has authorized the request. Call the
            // Authlete API with result=AUTHORIZED.
            completeWithAuthorized(ticket, user, claimNames, new Date());
            return;

        case deny:
            // When the end-user has rejected the request. Call the
            // Authlete's API with result=ACCESS_DENIED.
            completeWithAccessDenied(ticket, user);
            return;

        case timeout:
            // When the communication with the authentication device
            // timed out. Call the Authlete's API with
            // result=TRANSACTION_FAILED.
            completeWithTransactionFailed(ticket, user);
            return;

        default:
            // Unknown result. This should not happen. Call the Authlete's
            // API with result=TRANSACTION_FAILED.
            completeWithTransactionFailed(ticket, user);
            return;
    }
}

/**
 * Call Authlete's /api/backchannel/authentication/complete API
 * with result=AUTHORIZED.
 */
private void completeWithAuthorized(String ticket, User user, String[] claimNames, Date authTime)
{
    complete(ticket, user, Result.AUTHORIZED, claimNames, authTime);
}

/**
 * Call Authlete's /api/backchannel/authentication/complete API
 * with result=ACCESS_DENIED.
 */
private void completeWithAccessDenied(String ticket, User user)
{
    complete(ticket, user, Result.ACCESS_DENIED, null, null);
}

/**
 * Call Authlete's /api/backchannel/authentication/complete API
 * with result=TRANSACTION_FAILED.
 */
private void completeWithTransactionFailed(String ticket, User user)
{
    complete(ticket, user, Result.TRANSACTION_FAILED, null, null);
}

/**
 * Call Authlete's /api/backchannel/authentication/complete API to
 * convey the result of the communication with the authentication
 * device to Authlete.
 */
private void complete(String ticket, User user, Result result, String[] claimNames, Date authTime)
{
    // The subject of the end-user.
    String subject = user.getUserSubject();

    // The time at which the end-user was authenticated.
    // This is used only in the case of result=AUTHORIZED.
    long userAuthenticatedAt = (result == Result.AUTHORIZED) ? authTime.getTime() / 1000L : 0;

    // Claims of the end-user. This is used only in the case
    // of result=AUTHORIZED.
    Map<String, Object> claims = (result == Result.AUTHORIZED) ? collectClaims(user, claimNames) : null;

    // Call Authlete's /api/backchannel/authentication/complete API
    BackchannelAuthenticationCompleteResponse response =
        callBackchannelAuthenticationComplete(ticket, subject, result, userAuthenticatedAt, claims);

    // The 'action' in the response denotes the next action that
    // this authorization server should take.
    BackchannelAuthenticationCompleteResponse.Action action = response.getAction();

    // Process according to the 'action'.
    switch (action)
    {
        case SERVER_ERROR:
            // The API call was wrong or an error occurred on Authlete side.
            //
            // Throw an exception.
            throw new WebApplicationException( ResponseUtil.internalServerError(content) );

        case NO_ACTION:
            // Nothing to do. This happens when the backchannel token delivery
            // mode of the client is the POLL mode.
            return;

        case NOTIFICATION:
            // A notification must be sent to the client's notification endpoint.
            // This happens when the backchannel token delivery mode of the
            // client is either the PING mode or the PUSH mode.
            //
            // Notify the client.
            handleNotification(response);
            return;

        default:
            // Other cases. This should not happen.
            //
            // Throw an exception.
            throw new WebApplicationException(
                ResponseUtil.internalServerError("Unknown action returned from /api/backchannel/authentication/complete API.")
            );
    }
}

/**
 * Send a notification to the client's notification endpoint.
 */
private void handleNotification(BackchannelAuthenticationCompleteResponse info)
{
    // The URL of the client's notification endpoint.
    URI clientNotificationEndpointUri = info.getClientNotificationEndpoint();

    // The notification token which is used as a Bearer token.
    String notificationToken = info.getClientNotificationToken();

    // The content of the notification sent to the client in JSON format.
    String notificationContent = info.getResponseContent();

    // A response from the client's notification endpoint.
    Response response;

    try
    {
        // Send the notification to the client's notification endpoint.
        response = WEB_CLIENT.target(clientNotificationEndpointUri).request()
            .header(HttpHeaders.AUTHORIZATION, "Bearer " + notificationToken)
            .post(Entity.json(notificationContent));
    }
    catch (Throwable t)
    {
        // Failed to send the notification.
        throw new WebApplicationException(
            ResponseUtil.internalServerError("Failed to send the notification to the client", t)
        );
    }

    // The HTTP status code of the response from the client's notification endpoint.
    Status status = Status.fromStatusCode(response.getStatusInfo().getStatusCode());

    // Process according to the HTTP status code.
    //
    // Note that the specification does not describe how the response from
    // the client notification endpoint should be handled in the case where
    // the authorization server sends an error notification in the PUSH mode.
    // Therefore, this implementation handles the responses in the same way as
    // in other cases even when an error notification is sent in the PUSH mode.

    // When the status code is either '200 OK' or '204 No Content'.
    if (status == Status.OK || status == Status.NO_CONTENT)
    {
        // Based on the specification excerpted as below, regard that
        // the request has been processed successfully.
        //
        //   CIBA Core spec, 10.2. Ping Callback and 10.3. Push Callback
        //     For valid requests, the Client Notification Endpoint SHOULD
        //     respond with an HTTP 204 No Content.  The OP SHOULD also accept
        //     HTTP 200 OK and any body in the response SHOULD be ignored.
        //
        return;
    }

    // When the status code is '3xx'.
    if (status.getFamily() == Status.Family.REDIRECTION)
    {
        // Based on the specification excerpted as below, ignore this case.
        //
        //   CIBA Core spec, 10.2. Ping Callback, 10.3. Push Callback
        //     The Client MUST NOT return an HTTP 3xx code.  The OP MUST
        //     NOT follow redirects.
        //
        return;
    }
}

@Path("/api/token")
public class TokenEndpoint
{
   ...

    @POST
    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
    public Response post(
            @HeaderParam(HttpHeaders.AUTHORIZATION) String authorization,
            MultivaluedMap<String, String> parameters)
    {
        try
        {
            // The main process.
            return doProcess(authorization, parameters);
        }
        catch (WebApplicationException e)
        {
            // Known error
            return e.getResponse();
        }
        catch (Throwable t)
        {
            // Unknown error
            return ResponseUtil.internalServerError("Unknown error occurred.");
        }
    }

    private Response doProcess(String authorization, MultivaluedMap<String, String> parameters)
    {
        // Extract client credentials from the Authorization header.
        BasicCredentials credentials = BasicCredentials.parse(authorization);

        // Extract the client ID and the client secret from the client credentials.
        String clientId     = credentials == null ? null : credentials.getUserId();
        String clientSecret = credentials == null ? null : credentials.getPassword();

        // Call Authlete's /api/auth/token API.
        TokenResponse response = callToken(parameters, clientId, clientSecret);

        // The 'action' parameter in the response denotes the next action that
        // this authorization server should take.
        Action action = response.getAction();

        // The content of the response that should be returned to the client.
        // The content varies depending on the 'action'.
        String content = response.getResponseContent();

        // Process according to the 'action'.
        switch (action)
        {
            case INVALID_CLIENT:
                // Client authentication failed.
                // 401 Unauthorized
                return ResponseUtil.unauthorized(content, "Basic realm=\"token\"");

            case INTERNAL_SERVER_ERROR:
                // The API call was wrong or an error occurred on Authlete side.
                // 500 Internal Server Error
                return ResponseUtil.internalServerError(content);

            case BAD_REQUEST:
                // The token request was invalid.
                // 400 Bad Request
                return ResponseUtil.badRequest(content);

            case OK:
                // The token request was valid.
                // 200 OK
                return ResponseUtil.ok(content);

            case PASSWORD:
                // In the case of "Resource Owner Password Credentials" flow
                // which is defined in OAuth 2.0 (RFC 6749). This does not
                // happen in CIBA flows.
                // 400 Bad Request
                return ResponseUtil.badRequest("PASSWORD action returned from /api/auth/token API but this authorization server does not allow Resource Owner Password Credentials flow.");

            default:
                // Other cases. This should not happen.
                // 500 Internal Server Error
                return ResponseUtil.internalServerError("Unknown action returned from /api/auth/token API.");
        }
    }

    ...
}

{
  ...
  "user" : "{the end-user identifier}",
  ...
}

base_url = <base URL of Authlete API (e.g. https://api.authlete.com)>
service.api_key = <API Key of the service>
service.api_secret = <API Secret of the service>

mvn jetty:run -Dauthlete.ad.workspace=<CIBA simulator's namespace>/<CIBA simulator's project>