<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hello all!
<div class=""><br class="">
</div>
<div class="">My first post to this list. I’m working together with Sakib.</div>
<div class=""><br class="">
</div>
<div class="">Would it be possible to get reference to documentation or even better an example how to get the ”acr” claim included in an AuthenticationResponse? We are currently using shibboleth-identity-provider-3.4.1 with idp-oidc-extension-distribution-1.1.0. </div>
<div class=""><br class="">
</div>
<div class="">As we are using ”mod_auth_openidc” in Apache HTTPD at the Relying Party we have tried both suggested methods described in <a href="https://github.com/zmartzone/mod_auth_openidc/wiki/Step-up-Authentication" class="">https://github.com/zmartzone/mod_auth_openidc/wiki/Step-up-Authentication</a> without
success.</div>
<div class=""><br class="">
</div>
<div class="">The first method, where you add ”acr_values” to the AuthenticationRequest, leads us to the following question: How does one get ”acr_values_supported” to be included as a JSONArray in the OpenID configuration of the OpenID Connect Provider? Without
knowing what values the OP supports, it is impossible to set correct values to the ”acr_values" parameter.</div>
<div class=""><br class="">
</div>
<div class="">The second method, where you add a scope base on the currently requested location, assumes custom scope ”2factor” to be included in AuthenticationResponse, where I assume ”acr” claim to be included? How does one define such a scope? I’ve added
the following to "conf/attribute-filter-oicd.xml"</div>
<div class=""><br class="">
</div>
<div class=""> <AttributeFilterPolicy id="OPENID_AUTH"><br class="">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="2factor" /><br class="">
<AttributeRule attributeID="acr"><br class="">
<PermitValueRule xsi:type="ANY" /><br class="">
</AttributeRule><br class="">
</AttributeFilterPolicy><br class="">
<br class="">
</div>
<div class="">The filter policy makes reference to an attribute with id ”acr” which I do not know how to define. Please help.</div>
<div class=""><br class="">
</div>
<div class="">Regards</div>
<div class="">Per</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<b class="">Per Engström</b><br class="">
Systemutvecklare / Systems Developer<br class="">
<br class="">
<b class="">SMHI / Swedish Meteorological and Hydrological Institute</b><br class="">
SE - 601 76 NORRKÖPING<br class="">
<a href="http://www.smhi.se" class="">www.smhi.se</a><br class="">
<br class="">
E-post / Email: per.engstrom@smhi.se<br class="">
Tel / Phone: +46 (0)11 495 83 37<br class="">
Besöksadress / Street address: Folkborgsvägen 17</div>
</div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">27 okt. 2021 kl. 04:40 skrev Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>>:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 10/26/21, 8:44 AM, "users on behalf of Kicic Sakib" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:Sakib.Kicic@smhi.se" class="">Sakib.Kicic@smhi.se</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class=""> Is there any way to see on SP side in oidc token wich user authentication method was used e.g. password or<br class="">
x509?<br class="">
</blockquote>
<br class="">
The "acr" claim contains the authentication signal.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" class="">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>