Authentication level (ACR)

Enforce a level of assurance on how the user authenticates.

With acr_values you request a level of assurance on how the user authenticates with the IdP.

ACR	Meaning
`a3bc1`	Single-factor user authentication
`a3bc2`	Two-factor user authentication
`a3bc3`	Three-factor user authentication
`eidas-loa-low`	eIDAS level of assurance, low
`eidas-loa-substantial`	eIDAS level of assurance, substantial

Rules

A single value is accepted in acr_values (OIDC allows several).
Unlike the standard, the requested value is enforced: if the user cannot satisfy it, an error is returned.
When an ACR is requested, an acr claim is provided in the results.

This feature assumes alignment with the IdP’s authentication strategy. Check with A3BC which levels are actually available in your environment.