Last update:
Optional application integration
Aug 21, 2026
This section lists optional application integrations required when Application / Portal requires these capabilities.
Step-up AuthN & identification (portal high risk transaction)
Portals sometimes have “high-risk” transactions defined by them, which require higher level of security clearance than the regular login. HSID Aikyam EDA offers Step-up authentication (AuthN) and Identification mechanism, by utilizing the standard OIDC protocol and acr_values parameter.
Currently Step-up AuthN & Identification offers
- Authentication methods
- HSID MFA method (HSID-Registered Phone OTP verification – text or call)
- HSID AAL2 (Authentication Assurance Level 2)
- Identification methods
- HSID PBIC method (Phone Based Identity Confirmation)
- HSID IAL2 (Identity Assurance Level 2)
- HSID IAL1 Document verification
- HSID IAL1 Phone verification
Regarding the acr value for each method and differences between them, please refer to Authentication Context Class Reference (ACR) section.
When portal owners utilize this feature, please understand the following scope of this capability:
Common rules for all methods above:
- Step-up AuthN & Identification does not know the definitions of “high-risk” transactions. Each portal defines their “high-risk” transaction, and when the user is about to perform “high-risk” transaction, request Step-up AuthN to HSID Aikyam EDA.
- Step-up AuthN & identification does not manage whether the user went through “high-risk” transactions in the same HSID authenticated session. Portal needs to control whether they want to perform Step-up AuthN & Identification for every high-risk transaction, or, want to suppress it if the user went through high-risk transaction in the same portal session previously. This suppression policy is completely up to the portals.
- At the time of Step-up AuthN & identification, if HSID authentication session is expired or authentication cookie is not available, the user is prompted the login page and goes through the login process first, then Step-up AuthN & Identification is performed. In order to avoid the session expiration or unavailability, please use Aikyam Web SSO V2 endpoint, explained in Aikyam Web SSO V2 section.
HSID MFA / PBIC:
- HSID MFA / PBIC does not consider the fact whether the user went through HSID MFA (i.e. Phone OTP) / PBIC at the time of the login. Step-up simply performs HSID MFA or PBIC method when it is asked by the portal.
HSID AAL2:
- HSID AAL2 considers the fact whether the user satisfied AAL2 (i.e. passkey AuthN or password + Phone OTP AuthN) at the time of the login or anytime in the unexpired HSID authenticated session. Only when the authenticated session does not satisfy AAL2, Step-up AuthN performs an additional authentication to satisfy AAL2.
HSID IAL2:
- HSID IAL2 considers the fact whether the user satisfied IAL2 (i.e. Document Based Identity Confirmation – utilizing LexisNexis IDVerse and Flex ID) anytime during HSID account lifetime. Only if the user never satisfied IAL2 during their HSID account lifetime, Step-up Identification performs an additional identification to satisfy IAL2.
HSID IAL1 document verification:
- HSID IAL1 document verification considers the fact whether the user satisfied this verification anytime during HSID account lifetime, same as IAL2 above.
HSID IAL1 phone verification:
- HSID IAL1 phone verification considers the fact whether the user satisfied this verification anytime during HSID account lifetime, same as IAL2 above.
Previous:
Web SSO
Next:
Mobile application AAL2
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909