OIDC amr Reserved Claim

[Krenn, Martin]

HI,



As far as I know the only way to get amr values into an ID Token (outside of 
changing the reserved Claims) is with a IDTokenManipulationStrategy 
BiFunction.

I get my amr value from an IdpAttributePrincipal (not a DUO solution).



Best,

Martin













From: users <users-bounces at shibboleth.net> On Behalf Of Nathan Christopher 
Lewan via users
Sent: Tuesday, June 30, 2026 7:36 PM
To: Shib Users <users at shibboleth.net>
Cc: Nathan Christopher Lewan <nlewan at umd.edu>
Subject: OIDC amr Reserved Claim



hello!

I am working through an issue where I need to release acr/amr attributes to 
OIDC SPs to prove specific types of MFA have occured.

We are currently releasing 'https://refeds.org/profile/mfa' via the acr claim, 
which I would prefer not to mess with.



One option available to the OIDC SP in question is to consume the OIDC amr 
values passed to the SP from Shibboleth via the id_token, and use those values 
to determine if the SP likes what it sees.

I was trying to find a way to pass the DUO universal plugin jwt auth token amr 
values through to the SP. I see in 
'shibboleth.oidc.DefaultIDTokenReservedClaimNames' amr is a reserved claim 
name, which makes sense.

I am not looking to override the DefaultIDTokenReservedClaimNames, and produce 
a custom resolved attribute, as that doesn't feel like the proper road to 
take.

Is there any 'blessed' mechanism that will allow Shibboleth to assert the amr 
claims returned via DUO auth_token on to the authenticating OIDC SP?

Thanks for any assistance!



-- 

**

Nathan Lewan

IT Engineer - Identity and Access Management

Division of Information Technology

University of Maryland

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260701/98e20651/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 8305 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260701/98e20651/attachment.p7s>