feat(jans-auth-server): specify minimum ACR for clients

[martynaslawinska]

nynymike commented on Oct 10, 2018
Customers want to be able to force a certain level of authentication to access certain clients. Is it possible to look at the client_id, and if the current session does not match the required acr, to force authentication with the requisite acr.

yuriyz commented on Oct 10, 2018
Session tracks all clients that take part in SSO. So indeed we can check whether required level of acr is set per client or not. Do we want to have it as relative level number as defined by auth_level_mapping (on well-known json), e.g. 50 or set acr e.g. otp?

"auth_level_mapping": {
        "-1": ["auth_ldap_server"],
        "50": ["otp"],
        "100": ["basic"],
        "10": ["u2f"],
        "15": ["super_gluu"]
    }

I can take over it if needed.

qbert2k commented on Oct 12, 2018
There is already an array of default requested Authentication Context Class Reference values (default_acr_values) per client that can be overridden/forced by the request parameter acr_values.

nynymike commented on Oct 12, 2018
But only in the authentication phase. So if a person is already logged in, these are ignored. What we want to do is force reauthentication. For example, before a code is sent back to the client

[ossdhaval]

Tagging @nynymike as the original author

[yuriyz]

There is going to be new client properties:

• minimumAcrLevel - integer value which sets minimum acr level.
• minimumAcrLevelAutoresolve - boolean value, if false and minimumAcrLevel is higher then current acr_values then reject request. If true - resolve acr according to either client's minimumAcrPriorityList or AS auth_level_mapping
• minimumAcrPriorityList - enables client to specify the acr order of preference, rather then just the next lowest integer value

For example, given:

1. minimumAcrLevel = 14
2. default_acr_values = "basic"
3. minimumAcrPriorityList = ["u2f", "passkey", "usb_fido_key", "super_gluu"]
4. OP auth_level_mapping :

"auth_level_mapping": {
        "1": ["basic"],
        "5": ["otp"],
        "10": ["u2f"],
        "11": ["super_gluu"],
        "20": ["passkey"],
        "30": ["usb_fido_key"]      
    }

• if current acr_values=u2f and minimumAcrLevelAutoresolve=false -> request is rejected
• if current acr_values=u2f and minimumAcrLevelAutoresolve=true -> acr_values set to acr_values=passkey and request continue processing
• if current acr_values=usb_fido_key -> current acr is higher then minimum. Thus nothing to do.

If minimumAcrPriorityList is missing, then the AS can pick the next highest acr in the auth_level_mapping. In the example above, that would be passkey.

[nynymike]

The client should ideally have more control over this priority. I updated your example above.

[yuriyz]

@nynymike I like it, agreed.