Acr Values

Space-separated Authentication Context Class Reference values the authentication is requested to satisfy,
in order of preference.

• urn:hedia:acr:regular — satisfied by any authenticated user.
• urn:hedia:acr:elevated — requires the End-User to verify their password.

This parameter requests the acr Claim as a Voluntary Claim, so the Authorization Server attempts to
satisfy the requested class but does not treat an unmet one as a failed authentication. The class the
authentication actually satisfied is returned as the acr Claim of the ID token, and unrecognised values
are ignored, so clients must check that claim.

Requesting acr as an Essential Claim through the claims request parameter, which would require an
unmet class to fail the request, is not supported.