OIDC amr Reserved Claim

[Nathan Christopher Lewan]

hello!

I am working through an issue where I need to release acr/amr attributes to
OIDC SPs to prove specific types of MFA have occured.

We are currently releasing 'https://refeds.org/profile/mfa' via the acr
claim, which I would prefer not to mess with.

One option available to the OIDC SP in question is to consume the OIDC amr
values passed to the SP from Shibboleth via the id_token, and use those
values to determine if the SP likes what it sees.

I was trying to find a way to pass the DUO universal plugin jwt auth token
amr values through to the SP. I see in
'shibboleth.oidc.DefaultIDTokenReservedClaimNames' amr is a reserved claim
name, which makes sense.

I am not looking to override the DefaultIDTokenReservedClaimNames, and
produce a custom resolved attribute, as that doesn't feel like the proper
road to take.

Is there any 'blessed' mechanism that will allow Shibboleth to assert the
amr claims returned via DUO auth_token on to the authenticating OIDC SP?

Thanks for any assistance!

-- 
**
Nathan Lewan
IT Engineer - Identity and Access Management
Division of Information Technology
University of Maryland
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260630/0634e0e0/attachment.htm>