Entra OIDC proxying and ACR values

[Wessel, Keith]

Sure, Scott, but that makes my question even more interesting. If you can define these ACR values in Entra, how does the client signal to use them? That's my question. If acr_balues by definition doesn't imply "essential: true", that's fine. I just want to know how to get Entra to recognize the request at all.

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Tuesday, April 1, 2025 12:20 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Entra OIDC proxying and ACR values

> Microsoft doesn't advertise supporting requested claims in
> their OP metadata, so it's using acr_values.

FWIW, the spec makes that an optional sort of semantic, so I considered it unusable, and the spec I wrote for REFEDS was to request the acr claim as an essential claim, otherwise it just didn't mean anything to do it.

So I'm not really too shocked acr_values wouldn't work, it's not supposed to force the OP to do anything.

-- Scott