Authentication Method Reference Values
Extracted elements (17)
Each 'amr' value intentionally covers a family of closely related authentication methods rather than distinguishing every implementation variant. For example, 'otp' covers both HOTP and TOTP, and 'fpt' covers fingerprint matching regardless of algorithm or sensor model, because most relying parties only need to know which broad method was used.
The set of defined values is intentionally small and limited to distinctions already useful to relying parties in practice. Finer-grained distinctions would hurt interoperability by forcing relying parties to recognize multiple values that mean the same thing to them.
'amr' (Authentication Methods References) and 'acr' (Authentication Context Class Reference) are related but distinct. 'acr' states which business-rule class was satisfied without describing how; 'amr' states which specific methods were used. Relying on 'amr' values is considered more brittle than 'acr' because appropriate authentication methods evolve over time.
OAuth 2.0 is designed for resource authorization and cannot be used for authentication without appropriate extensions such as OpenID Connect Core 1.0. The existence of 'amr' claim values should not be taken as encouragement to use OAuth 2.0 for authentication without such extensions.
Authentication Method Reference Names are RECOMMENDED to be short, not exceeding 8 characters without a compelling reason, because a core goal is compact representations.
Authentication Method Reference Names in the registry MUST use only printable ASCII characters excluding double quote and backslash (Unicode code points U+0021, U+0023–U+005B, U+005D–U+007E). Names are case sensitive and may not match other registered names in a case-insensitive manner unless Designated Experts grant an exception.
The list of 'amr' claim values returned in an ID Token reveals information about how the end user authenticated to the identity provider, which may have privacy implications. Storage and protection of referenced credentials (e.g., biometric data) is out of scope for this specification.
Additional method reference values: 'rba' (risk-based authentication), 'user' (user presence test, also called 'test of user presence' per W3C WebAuthn), and 'wia' (Windows Integrated Authentication). These cover adaptive, proximity, and platform-specific authentication approaches.
Biometric authentication method reference values defined: 'face' (facial recognition), 'fpt' (fingerprint), 'iris' (iris scan), 'retina' (retina scan), and 'vbm' (voiceprint). Each identifies a family of closely related biometric authentication methods without mandating specific implementation details.
Knowledge and credential-based authentication method reference values: 'kba' (knowledge-based authentication per NIST 800-63-2), 'pin' (Personal Identification Number or pattern used to unlock a device key), and 'pwd' (password-based authentication).
Multi-factor and multi-channel authentication method reference values: 'mfa' (multiple-factor authentication, may co-occur with specific method values) and 'mca' (multiple-channel authentication involving more than one distinct communication channel, e.g., browser plus telephone call).
One-time password method reference value 'otp' intentionally covers both HOTP (RFC 4226) and TOTP (RFC 6238) families. The single identifier satisfies either OTP variant, allowing relying parties to confirm OTP use without distinguishing between HMAC-based and time-based implementations.
Out-of-band confirmation method reference values: 'sms' (confirmation via SMS text to a registered number), 'tel' (confirmation by telephone call, also called 'call back'), and 'geo' (use of geolocation information for authentication per W3C Geolocation API).
Possession-based authentication method reference values: 'hwk' for Proof-of-Possession of a hardware-secured key and 'swk' for Proof-of-Possession of a software-secured key. Both reference the PoP concept from RFC 4211 Appendix C.
The 'amr' (Authentication Methods References) claim is a JSON array of case-sensitive strings identifying authentication methods used during authentication. It is defined in OpenID Connect Core 1.0 and registered in the IANA 'JSON Web Token Claims' registry. This specification defines the standard values for that array.
Establishes the IANA 'Authentication Method Reference Values' registry for 'amr' claim array element values. Registration requires Expert Review after a three-week review period on the [email protected] mailing list. The registry records the Authentication Method Reference value and a reference to the specification that defines it.
The security considerations of OpenID Connect Core 1.0, OAuth 2.0 (RFC 6749), and the OAuth 2.0 Threat Model (RFC 6819) all apply. Additionally, taking a hard dependency on specific authentication methods creates brittle systems because appropriate methods vary over time as attacks evolve and new methods are deployed.