Re: [Unity-idm-discuss] signaling 2FA usage

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 03.03.2022 o 11:12, Sander Apweiler pisze:
> Hi Krzysztof,
> sorry for extending the question, but it is related to this. Would it
> possible to signal this in the ACR claim in OIDC and section in SAML?
> This might be the best way for services to use this information. I do
> not expect that this will work in the next release.

After the simple enhancement as discussed so far adding the acr claim 
should not be a big problem in output profile.

As for SAML subject confirmations (or any dedicated support for ACRs in 
OIDC) - that's broader topic. We even have some old ticket about this in 
SAML context. Surely we would need to discuss requirements here. This is 
pretty fuzzy subject as number of standards, specs, and approaches used 
is very wide, and it is hard to design a solution working well for (at 
least) all the major use cases.

Best,
Krzysztof