amr
Registry Context
The amr claim identifies the authentication methods used for the End-User authentication, such as password and OTP. In an ID Token it is optional, and when used its values should come from the IANA Authentication Method Reference Values registry unless the parties agree on context-specific unregistered meanings.
Technical Summary
In OpenID Connect ID Tokens, amr is an OPTIONAL claim whose value is a JSON array of case-sensitive strings identifying authentication methods used in the authentication. Values used in the amr claim SHOULD be from the IANA Authentication Method Reference Values registry established by RFC 8176; unregistered values require agreement between the parties on their meanings.
When Used
Used in OpenID Connect ID Tokens when the issuer wants to communicate which authentication methods were used for the End-User authentication.
Normative Requirements
Unspecified actor
openid-connect-core-1_0 - Section 2
Use amr claim values from the IANA Authentication Method Reference Values registry established by RFC 8176..
Condition: When values are used in the amr claim; parties using unregistered values need to agree on their meanings, which may be context specific.
Values used in the amr Claim SHOULD be from those registered in the IANA Authentication Method Reference Values registry IANA.AMR established by RFC8176; parties using this claim will need to agree upon the meanings of any unregistered values used, which may be context specific.
openid-connect-core-1_0 - Section 2
Include the amr claim as an Authentication Methods References claim in an ID Token..
Condition: When representing authentication method references for the End-User authentication in an OpenID Connect ID Token.
OPTIONAL. Authentication Methods References.
Validation Guidance
Do not require the amr claim to be present in every ID Token solely because it is registered; OpenID Connect Core marks it OPTIONAL.
If amr is present, validate that its value is a JSON array of strings and treat those strings as case-sensitive.
Warn when amr values are not registered in the IANA Authentication Method Reference Values registry and no local agreement for their meanings is known.
Reference
Details
- Entry Id
amr- Claim Name
amr- Claim Description
Authentication Methods References- Change Controller
OpenID_Foundation_ Artifact_ Binding_ Working_ Group - Reference
OpenID Connect Core 1.0 - Section 2