<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">That is true but normally the levels are not defined in a protocol document. They would be in a trust framework document that details how to conform to them including all the legal and business practice agreements.<div class=""><br class=""></div><div class="">All we can say is that all of that is dealt with someplace else and the URI indicate the means by which the subject was most recently authenticated.</div><div class=""><br class=""></div><div class="">One of the hard things with LoA is that better might be subjective. There is no guarantee in general that one is better than another as they might theoretically mitigate different risks.</div><div class=""><br class=""></div><div class="">For MODRNA LoA it looks like we are going to have three dimensions for what would normally all be bound up in a single loa number in 29115/SP800-63</div><div class="">a) Identtiy proofed [ “True” , “False”] (can the IdP legally identify the subject)</div><div class="">b) Proof of Possession [ “True” , “False”] (in 800-63 PoP is required for LoA 4, but we can deal with it separately in the protocol)</div><div class="">c) Strength of Primary credential [ “single factor”, “multi-factor soft-key”, “ multi-factor hard key” ]</div><div class=""><br class=""></div><div class="">In the first stage we are only asserting non proofed subjects.</div><div class=""><br class=""></div><div class="">That gives us three levels now and eventually six to plan for.</div><div class=""><br class=""></div><div class="">In reality the user will have a token with a HW or software key, so as a RP asking specifically for one or the other doesn’t make much sense.</div><div class=""><br class=""></div><div class="">As a RP I think that you want to be able to say force the user to 2nd factor if there current login is single factor, or I will take what the user is logged in as.</div><div class=""><br class=""></div><div class="">Lets assume for the moment that amr in the response can differentiate between hard and soft keys.</div><div class=""><br class=""></div><div class="">That would leave us with two acr values to ask for. Lets call them 1F and 2F for the moment. </div><div class=""><br class=""></div><div class="">That would give us:</div><div class="">[ “1F” ] == Give me what the user has logged in at, don’t force step up.</div><div class="">[ “2F” , "1F" ] == Force the user to do two factor if there device supports it, but I will take single if that is all there device supports.</div><div class="">[ “2F” ] == Force the user to do two factor if there device supports it, return an error if 2F is not available.</div><div class=""><br class=""></div><div class="">In the response the “amr” will indicate if the authentication was with HW or SW based keys.</div><div class=""><br class=""></div><div class="">It strikes me that trying to add another LoA complicates things for the RP. </div><div class=""><br class=""></div><div class="">I suspect that for initial login most sites will want [ “1F” ] and do [ “2F” , "1F" ] for step up around specific transactions. </div><div class="">Banks will want [ “2F” , "1F" ] all the time.</div><div class="">Asking for [ “2F” ] on its own is not as useful as asking for [ “2F” , "1F" ] at-least if you get back a LoA with “1F” then you know it is probably the correct person as opposed to any random person who could generate an error, at that point you can guide them through some other step up or tell them to use a different device etc. However some people may have limited RP logic and be happier with an error.</div><div class=""><br class=""></div><div class="">So as an example if the user has authenticated with “2F” but the RP asks for [ “1F” ] then we would expect the IdP not to prompt (assuming max-age is ok) and return “2F” as the acr in the response along with a amr indicating if the key was HW or SW protected. </div><div class=""><br class=""></div><div class="">It might make sense in non modrna cases to have a RP specifically ask for a HW backed multi-factor. The IdP could force the user to use a smart card with match on card biometrics on a different computer, rather than using the soft token on the phone. How ever I don’t think that is our use-case, and having an extra thing the RP can ask for just adds to the complexity.</div><div class=""><br class=""></div><div class="">If we need to have three for some political reason I would have the IdP treat the two multi-factor as equivalent in the request, and only differentiated in the response.</div><div class=""><br class=""></div><div class="">Thoughts on paring it down to two?</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Nov 27, 2015, at 2:19 PM, Lodderstedt, Torsten <<a href="mailto:t.lodderstedt@telekom.de" class="">t.lodderstedt@telekom.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">As a RP, I would prefer to send the minimal level I would like the OP to fulfill, e.g. mc2, and I would accept if the OP did better, i.e. authenticated using mc3.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I think it is evenly important to be clear on the meaning of the levels. Otherwise, the RP does not know what to expect and the OP does not know exactly know what to implement.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Best regards,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Torsten.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class="">Von:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class=""><span class="Apple-converted-space"> </span>John Bradley [<a href="mailto:jbradley@mac.com" class="">mailto:jbradley@mac.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Gesendet:</b><span class="Apple-converted-space"> </span>Freitag, 27. November 2015 15:14<br class=""><b class="">An:</b><span class="Apple-converted-space"> </span>Lodderstedt, Torsten<br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:philippe.clement@orange.com" class="">philippe.clement@orange.com</a>; <a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Betreff:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-mobile-profile] ACR values<o:p class=""></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">That is not the normal behaviour for Connect when using the query parameter. <o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We had much debate at the time. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We can achieve that with server side policy however. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">What I think people want is to send a list in preference order eg [ “mc-2”, “mc-3” ] <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The IdP must try to do the highest one in the list that the users device supports, if that fails then the IDP will return an error.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">That is the semantic if you use make it an essential claim in the request object.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Normally if the device only supported “mc-1” or “mc-4" the IdP could try that and return it if successful. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I suppose that we could say that if the user can be authenticated at a higher level by the IdP it can do that and return a lower level from the requested list.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">This is probably more important to be clear on than the levels themselves in some ways.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Is that the behaviour we want to require of the IdP?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">John B.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Nov 27, 2015, at 8:51 AM, Lodderstedt, Torsten <<a href="mailto:t.lodderstedt@telekom.de" style="color: purple; text-decoration: underline;" class="">t.lodderstedt@telekom.de</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="color: rgb(31, 73, 125);" class="">></span><span lang="EN-US" class="">If the IdP cant supply one of the acr values by getting the user to step up then it must return a failed authentication<span class="apple-converted-space"><span style="color: rgb(31, 73, 125);" class=""> </span></span>attempt.</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I think this is the desired behavior for MODRNA</span><o:p class=""></o:p></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">_______________________________________________<br class="">Openid-specs-mobile-profile mailing list<br class=""></span><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">Openid-specs-mobile-profile@lists.openid.net</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""></span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</span></a><o:p class=""></o:p></div></div></blockquote></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Openid-specs-mobile-profile mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Openid-specs-mobile-profile@lists.openid.net</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</a></div></blockquote></div><br class=""></div></body></html>