Authentication context claims

Strivacity provides authentication context in ID tokens through the amr and acr claims. These claims allow an OIDC client to evaluate the authentication event without relying on the details of the login journey that produced it.

• amr identifies the authentication methods used during the authentication event.
• acr identifies the authentication context or assurance level achieved.

OIDC clients can also use the acr_values authorization request parameter to indicate preferred authentication context values.

Authentication methods

The amr claim identifies the authentication methods used during the current authentication event. It is returned as an array and can contain the following values:

An authentication method can contribute more than one value. For example, authentication using a password followed by an SMS OTP produces:

["pwd", "otp", "sms", "mfa"]

Only authentication methods used during the current authentication event are included.

Authentication context

The acr claim identifies the authentication context achieved during the authentication event. Unlike amr, it contains a single value.

Strivacity supports the following values:

OIDC clients can use the acr_values authorization request parameter to indicate preferred authentication context values. Specify multiple values as a space-separated list in order of preference.

For example:

acr_values=phrh urn:strivacity:acr:2

Strivacity evaluates the recognized values in the requested order and returns one acr value. The acr_values parameter expresses a preference and does not require Strivacity to satisfy the requested authentication context.

Authentication context claims can also be included in access tokens, depending on the application client configuration.