<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
tt
{mso-style-priority:99;
font-family:"Courier New";
color:#003366;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Sure. I'll start by including the two different definitions, for reference:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif";color:black">acr<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span lang="EN" style="font-family:"Verdana","sans-serif";color:black">OPTIONAL. Authentication Context Class Reference. String specifying an Authentication Context Class Reference value that identifies the Authentication
Context Class that the authentication performed satisfied. The value "0" indicates the End-User authentication did not meet the requirements of
<a href="http://openid.net/specs/openid-connect-messages-1_0.html#ISO29115">ISO/IEC 29115</a> [ISO29115] level 1. Authentication using a long-lived browser cookie, for instance, is one example where the use of "level 0" is appropriate. Authentications with
level 0 should never be used to authorize access to any resource of any monetary value. (This corresponds to the OpenID 2.0
<a href="http://openid.net/specs/openid-connect-messages-1_0.html#OpenID.PAPE">PAPE
</a> [OpenID.PAPE] </span><tt><span lang="EN" style="font-size:12.0pt">nist_auth_level</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif";color:black"> 0.) An absolute URI or a
<a href="http://openid.net/specs/openid-connect-messages-1_0.html#RFC6711">registered name</a> [RFC6711] MAY be used as an
</span><tt><span lang="EN" style="font-size:12.0pt">acr</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif";color:black"> value.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif";color:black">amr<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span lang="EN" style="font-family:"Verdana","sans-serif";color:black">OPTIONAL. Authentication Methods References. JSON array of strings that are identifiers for authentication methods used in the authentication.
For instance, values might indicate that both password and OTP authentication methods were used. The definition of particular values to be used in the
</span><tt><span lang="EN" style="font-size:12.0pt">amr</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif";color:black"> Claim is beyond the scope of this specification.
<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The key difference is that “acr” references the single authentication CLASS that the authentication event satisfied, whereas “amr” lists the set of individual authentication METHODS used in the authentication event. The first is likely
closely tied to the trust framework within which the authentication occurred. For instance, the “acr” might be used to say that the authentication performed met the requirements of an EU Stork Level 3 authentication, whereas the “amr” might communicate that
the authentication event did so by using a Belgian EID card (one claim returned) on a computer that meets the patch requirements of the EU Ministry of Defense (another “amr” claim returned). Other “acr” references would be things like the US Government NIST
Authentication Levels specified in NIST SP 800‑63 or trust framework references to elements frameworks defined with the OIX. Other “amr” references would be things like “used a password”, “used an OTP device”, “used a code sent out of band in a text message”,
etc. The first are references classes of authentication defined in legal contracts. The latter are references to physical events that took place.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Does that help?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> -- Mike<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net] On Behalf Of Torsten Lodderstedt<br>
Sent: Friday, May 31, 2013 11:02 AM<br>
To: OpenId Connect List<br>
Subject: [Openid-specs-ab] amr vs acr</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hi,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">could someone please describe me the difference between the id token members acr and acm? From my understanding, they are just the same. I'm also interested to learn why the authorization request allows to specify multiple acrs but does
not support to specify any authentication method (via acm). Additionally, why is there no way to indicate more than one acr in the id token?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks in advance,<o:p></o:p></p>
<p class="MsoPlainText">Torsten.<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Openid-specs-ab mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Openid-specs-ab@lists.openid.net"><span style="color:windowtext;text-decoration:none">Openid-specs-ab@lists.openid.net</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab"><span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a><o:p></o:p></p>
</div>
</body>
</html>