How SAML AuthnContext and OIDC AMR/ACR Support Step-Up Authentication

Summary

The explainer describes how SAML AuthnContext and OpenID Connect AMR and ACR convey authentication methods and assurance levels, helping applications make access decisions and request stronger authentication for sensitive actions.

Key points

• SAML AuthnContext describes the type or context of authentication performed.
• OpenID Connect AMR identifies authentication methods used, such as passwords or one-time passwords.
• OpenID Connect ACR represents an overall authentication assurance level or set of requirements.
• Applications can use authentication context to decide whether a session is sufficient for an action.
• For sensitive actions, applications can request a stronger SAML AuthnContext or a higher OIDC ACR.
• Different authentication methods may satisfy the same assurance requirement.