Mobile application AAL2

When mobile application needs AAL2 for their users, mobile application needs to consider two different authentication use cases, and each case requires a different Step-up AuthN method.

• HSID authentication (use HSID email / password): HSID AAL2 (urn:aikyam:aal:aal2)
• Mobile Biometrics (non-HSID) authentication: HSID MFA (urn:aikyam:aal:mfa)

Mobile biometrics authentication currently utilizes long-lived HSID Aikyam EDA refresh token. When using a fresh ID token generated from this refresh token to generate HSID authenticated session (Web SSO V2 endpoint), it preserves the original AMRs (likely including “otp”, which satisfies AAL2) which were acquired long time back. For this reason, it is recommended that Mobile application uses HSID MFA method to enforce MFA for all mobile biometrics authenticated users from security perspective.

Mobile application should persist the information whether this Step-up AuthN has been completed for this user or not within the active session, to avoid excessive MFA / AAL2 challenge. When mobile application session is terminated (close the app, certain amount of inactivity, etc), then the user should re-obtain mobile application AAL2 as described above.