AuthNContext and AMR, We Remember What MFA You Provided Last Summer!
Summary: SAML's AuthnContext attribute and OpenID Connect's AMR claim both exist to record not just that a user signed in but which authentication methods were used, with AMR values standardized in RFC 8176 as short references such as pwd for password and otp for one-time password. OpenID Connect adds the ACR claim, which describes the overall level of assurance the authentication satisfied rather than the individual factors, so a password plus OTP and a hardware-backed credential can carry different AMR values while meeting the same ACR requirement.
Key Takeaway: An application that only checks whether a login succeeded cannot tell a reused password from a hardware key and biometric check, so a session opened to read account information can be reused to change payout details unless the application inspects AMR and ACR and requests a step-up. The practical question for your architecture is whether it can act on the quality of authentication, not just its presence.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026