Michael Schwartz, Gluu

Yuriy Movchan, Gluu

Use Case

"Adaptive authentication" requires minimal authentication, and "stepped-up" authentication for privilege escalation. The goal of adaptive authentication is to improve the security and user experience of authentication. 

Organizations are struggling to implement adaptive authentication.  They need to make the devices smart enough to request a specific type of authentication. For example, if your device has a fingerprint reader, or you have a USB security token, you need the device to request a certain type of authentication.

In the Gluu OP, we enable the domain to define multiple types of authentication. Each new type of authentication has a "name" and "level." The name is a string identifier, and the level is an integer specifying the relative strength of the authentication mechanism, as defined by the policies of that domain. 

Organizations can define internal standards for the names and relative strength of the authentications mechanism that they offer. Inter-domain, multi-party federations may also find it useful to define conventions for authentication mechanisms. 

Discovery

The domain SHOULD publish the types of authentication available in the format:

"authtypes_supported": [ ["basic",10], ["certificate", 20], ["token", 25]...] 

Authentication Parameters

If a client requests a specific type of authentication using the "auth_mode" or "auth_level" parameters, the OP SHOULD accommodate the client. 

auth_mode=duo

auth_level=10

Access Token

It is useful for a host to understand the authentication strength used to obtain the access token. For this reason, the OP SHOULD persist the auth_mode and auth_level in the access token.

"auth_mode": "duo"
"auth_level": 10

Comments

How does this differ from ACR?
ACR in OpenID Connect is intended to align with ACR in SAML. Although ACR is generic, and does not require identity proofing concerns, several defined ACR's couple them, including: ISO 29115:2013,  InCommon Silver, and other National Standards like SP800-63. A complete list of SAML authn contexts are available at OASIS. "auth_mode" and "auth_level" are intended to be more agile, and may be a component of policies expressed in the ACR.