Last update:
Error case and handling
Aug 21, 2026
When the user could not complete Step-up AuthN & Identification with multiple failures, the behavior / handling would be different per acr value that Portal requested.
- urn:aikyam:aal:mfa (MFA) / urn:aikyam:aal:aal2 (AAL2)
- HSID account would be locked.
- The user is redirected to “Account recovery” (phone number change) process.
- urn:aikyam:ial:pbic (PBIC)
- HSID account would NOT be locked and HSID authenticated session would NOT be terminated (This is due to the fact that 1) PBIC can utilize different phone number, and 2) PBIC has a lower success rate than MFA because of the identity check).
- HSID returns OIDC authentication error response with unmet_authentication_requirements.
- It is up to portal how to handle this error.
- urn:aikyam:ial:ial2 (IAL2) / urn:aikyam:ial:ial1docVerification (IAL1 Document verification)
- As previously mentioned, these acrs need to be combined with authentication acrs (MFA or AAL2). When the user gets error during MFA / AAL2 authentication, the error experience would be the same as MFA / AAL2 explained above.
- When the user gets error during Document Verification, HSID UI shows error without their account locking. The user could go back to the portal owned sign-in page to proceed features that do not require IAL2 / IAL1 Document verification.
- urn:aikyam:ial:ial1phoneVerification (IAL1 Phone verification)
- IAL1 Phone Verification also needs to be combined with authentication acrs, and the error behavior during the authentication is the same as MFA / AAL2 explained above.
- When IAL1 Phone verification fails, it falls back to IAL1 Document verification.
- The rest of the error handling is the same (IAL1 Document Verification) as above.
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909