return an acr Claim Value that matches one of the requested values.

Condition: if the acr Claim is requested as an Essential Claim for the ID Token with a value or values parameter requesting specific Authentication Context Class Reference values and the implementation supports the claims parameter

If the acr Claim is requested as an Essential Claim for the ID Token with a value or values parameter requesting specific Authentication Context Class Reference values and the implementation supports the claims parameter, the Authorization Server MUST return an acr Claim Value that matches one of the requested values.

treat the outcome as a failed authentication attempt.

Condition: if the acr Claim is Essential and the requirement cannot be met

If this is an Essential Claim and the requirement cannot be met, then the Authorization Server MUST treat that outcome as a failed authentication attempt.

return the session's current acr as the value of the acr Claim.

Condition: if the Claim is not Essential and a requested value cannot be provided

If the Claim is not Essential and a requested value cannot be provided, the Authorization Server SHOULD return the session's current acr as the value of the acr Claim.

ask the End-User to re-authenticate with additional factors.

Condition: to meet an Essential acr Claim request

The Authorization Server MAY ask the End-User to re-authenticate with additional factors to meet this requirement.

include the acr claim as an Authentication Context Class Reference claim.

Condition: within an ID Token

OPTIONAL. Authentication Context Class Reference.

use authentications with level 0 to authorize access to resources of monetary value.

Condition: when the acr value is "0"

Authentications with level 0 SHOULD NOT be used to authorize access to any resource of any monetary value.

use an absolute URI or an RFC 6711 registered name as the acr value.

An absolute URI or an RFC 6711 registered name SHOULD be used as the acr value;

use registered names with a meaning different from the registered meaning.

Condition: when an RFC 6711 registered name is used as the acr value

registered names MUST NOT be used with a different meaning than that which is registered.

request the acr Claim as a Voluntary Claim.

Condition: by using the acr_values request parameter or by not including "essential": true in an individual acr Claim request

Note that the RP MAY request the acr Claim as a Voluntary Claim by using the acr_values request parameter or by not including "essential": true in an individual acr Claim request.