Purpose of the parameter acr_values in OIDC CA Access Gateway (SPS)

Products

• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

 

When running CA Access Gateway (SPS) for OIDC, what's the use of the URI parameter?

  acr_values=http://idmanagement.gov/ns/assurance/loa/1

To illustrate:

   https://example.example.com/affwebservices/secure/secureredirect?client_id=4455154-4103-487d-8c88-00c78041dd0b&response_type=code&scope=openid%20email%20profile&redirect_uri=https://myotherserver.mydomain.com/handlers/sso/OIDC/AuthResultHandler.php&state=wefss55-9bca-4a44-af93-305671a6fdc4&openid.realm=&ds=&acr_values=http://idmanagement.gov/ns/assurance/loa/1&nonce=9a25c24ec18d474cbb5504d702ce9cf9&SMPORTALURL=c3qUzvbZGCkE7VkfFS%2FVaxo

 

Resolution

 

As per the OIDC recommendation and RFC standards, this URL is expected as value a value (1).

The URL value can be HTTP or HTTPS too (2).

From the documentation, when configuring an OIDC Provider, there's also a possibility to configure ACR (3).

 

Additional Information

 

(1)

    5. Authentication Context

      OpenID Providers MUST provide acr (authentication context class
      reference, equivalent to the Security Assertion Markup Language (SAML)
      element of the same name) and amr (authentication methods reference)
      values in ID tokens.

      It is RECOMMENDED that the standardized Uniform Resource Identifiers
      (URIs) established by the Federal Identity, Credential, and Access
      Management (FICAM) Trust Framework be used for the acr values:

      LOA 1: http://idmanagement.gov/ns/assurance/loa/1

    

(2)

    Registration Template

   Informational URL:  A URL containing auxiliary information.  This URL
   must minimally reference contact information for the
   administrative authority of the level of assurance definition and
   must use either the http or https scheme.

    

(3)

    Configure SiteMinder as OpenID Connect Provider

      Enable Dynamic Authentication Mode

      Specifies whether Dynamic Authentication Mode must be enabled for allowing OIDC clients to send AuthenticationContextRequest in the authorization request and dynamically select the minimum authentication level and the Authentication URL for user authentication and authorization.
      In this mode, define one or more Authentication Context Requests (ACRs) that allow SiteMinder to authenticate users based on the acr_value parameter that was sent in the request. Each ACR is configured with an authentication level range and Authentication URL.When client sends a request with an ACR that is already configured, SiteMinderverifies if SMSESSION exists for the client session. If SMSESSION exists and is less than the authentication level range of the ACR that is sent in the request, the client is challenged for credentials as per the authentication scheme that is configured in Authentication URL.
      The following fields are displayed when you select this option:
      ACR

      Defines the name of the ACR. You can define multiple ACRs. You can send an ACR in the authentication request along with the other supported parameters.