Authentication and security

Step-up AuthN is used for high-risk transactions to add an additional layer of authentication (2FA or Phone Based Identity Confirmation). Use it when a user needs to perform sensitive operations like changing payment methods or accessing sensitive information.

Reference : Step-up AuthN (portal high risk transaction)

Three ACR values are supported:

• urn:hsid:ial:one - Identity Assurance Level 1 (self-asserted attributes)
• urn:hsid:ial:eid - Identity Assurance Level with eID verification
• urn:aikyam:aal:mfa - Authenticator assurance level with Multi-factor authentication

Reference : Authentication Context Class Reference (ACR)

Add the acr_values parameter to your OIDC authorization request with either urn:aikyam:aal:mfa (for 2FA) or urn:aikyam:aal:pbic (for Phone Based Identity Confirmation). The user will be prompted for additional authentication, and you should verify the acr claim in the returned ID token.

Reference : Step-up AuthN (portal high risk transaction)