authn context comparison per relying party

[Scott Cantor]

> On Aug 24, 2026, at 5:13 PM, Michael Grady <mgrady at unicon.net> wrote:
> 
> Is there an "authoritative/up-to-date" list of "factor" values that Duo returns? I've had trouble surfacing anything that I was convinced was current and accurate, and more concerningly, thought I saw something that suggested Duo might consider "factor" to be deprecated.

The new amr claim values are documented, but I have no idea if they're stable. The factors definitely aren't, though they've always been more precise.

> The AMR value sets Duo are returning appear to me to be useless, as everything from standard Duo Push thru to the most secure methods return the same 3 values:
> 
>  ["mfa", "pop", "user"]

If so, then it's more or less down to precisely controlling the allowed methods on your integrations and limiting them very tightly I guess.

> and does not distinguish if Remember Me was used (if in place, you just get the value set from what was used to establish it in the first place.)

If you care about MFA, you basically have to disable Remember Me, and since the IdP already does effectively "remember" you, it doesn't really seem like that big an issue. The IdP and this are both browser-specific and cookie-based, but at least we allow address bindings.

There's nothing stopping people from allowing the IdP to issue results that last for weeks if they want to, and they're storable in the client, so I'd say it's equivalent.  Much like their group features, I think the IdP plus local IAM processes do just about  everything they do better, save for the core MFA process itself.

-- Scott