Last update:
Performing step-up AuthN and identification
Aug 21, 2026
To use Step-up AuthN & identification, please follow these steps:
- The user is on the portal application, with an unexpired HSID authenticated session (if HSID session is possibly expired, use in Aikyam web SSO V2 endpoint to re-instantiate HSID authenticated session first).
- The user is about to make high-risk transaction.
- Portal initiates Step-up AuthN & Identification OIDC. This OIDC is the same as Sign-in OIDC,just with an additional parameter, acr_values. acr_values controls the method / requirement of Step-up AuthN & identification.
- acr_values should include:
- Authentication methods
- urn:aikyam:aal:mfa (MFA – currently Phone OTP only)
- urn:aikyam:aal:aal2 (AAL2)
- Identification methods
- urn:aikyam:ial:pbic (Phone Based Identity Confirmation – Phone OTP + identity check)
- urn:aikyam:ial:ial2 (IAL2)
- urn:aikyam:ial:ial1docVerification (IAL1 Document Verification)
- urn:aikyam:ial:ial1phoneVerification (IAL1 Phone Verification)
Note: IAL2 / IAL1 Document & Phone Verification additionally require one of authentication method acr, at the time of this step-up OIDC. See the example URL above. (If your application is mobile, please refer to Mobile Application AAL2 section as well)properly encoded for the query string value. acr_values could be multiple, and it is space-delimited.https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest - Authentication methods
- scope should include (IAL2 / IAL1 Document verification / IAL1 Phone verification):properly encoded for the query string value. scope could be multiple, and it is space delimited.
- state value should have associated with “after Step-up AuthN & Identification portal landing page” information (portal interpretable deeplink or the actual URL) on the portal side. This association will be used when the portal gets callback (redirect_uri call). For the details, please see Using state parameter to control user’s landing location on portal.
- acr_values should include:
- The user is prompted with Step-up AuthN & identification (determined by acr_values), and completes the required authentication & identification.
- After the Step-up AuthN & identification completion, it is redirected to OIDC’s redirect_uri.
- OIDC redirect_uri processes Aikyam issued one time auth code (same as login) and retrieve OIDC tokens.
- ID token contains acr, amr, verified_claims claim (when it is requested in the scope parameter in the OIDC), and the portal validates these claims. What to validate is depending on what acr_values is requested:
- IAL / AAL related acrs: See validating the current assurance levels section. It uses amr, verified_claims claim.
- Other acrs: use acr claim whether it contains the requested acr at the time of OIDC. acr claim could contain multiple values with a comma delimiter. This is a part of the standard OIDC client ID Token Validation (Step 12) should be done by the portal.
- OIDC redirect_uri also receives state according to OIDC spec. As previously mentioned, state value should have been associated with “after Step-up AuthN & Identification portal landing page” information, therefore, retrieve the information and redirect to that page, once acr verification above is done.
- The user lands on high-risk transaction page (after Step-up AuthN & Identification portal landing page) and continues the transaction.
Previous:
Mobile application AAL2
Next:
Error case and handling
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909