Assurance levels

The OneWelcome Identity Platform uses assurance levels and authentication context class reference (ACR) values to indicate the strength and security of authentication methods. These concepts help ensure that users are properly authenticated and that access to resources is granted based on the appropriate level of trust.

Assurance levels

Assurance levels, also known as levels of assurance (LOA) or service levels, indicate the degree of confidence in the trustworthiness of a user or transaction. They define the strength of the identity proofing, credential management, and authentication processes that are used. Higher assurance levels imply a greater degree of certainty that a user is who they claim to be.

Define assurance levels

In the OneWelcome Identity Platform, you define the assurance levels on the console or with the Access Config and End-User APIs.

Each assurance level includes:

• a name

• a level (a number between 0 and 100)

You can then use those assurance levels in authentication journeys, where you can select the assurance level that each authentication method in a journey provides.

1. On the OneWelcome Identity Platform console, select Applications > Authentication assurance levels.

   

2. Select Add assurance level.

3. On the Add assurance level page, enter a Name for the assurance level.

   The name is used in SAML and OIDC authentication requests.

4. Enter a Level between 0 and 100.

   Higher numbers indicate a stronger assurance, but the level doesn't necessarily represent a security strength.

5. Select Save.

Step-up authentication with assurance levels

Authorization requests can require a higher assurance level when needed.

You can provide the assurance level for both OIDC and SAML requests:

• OIDC requests use the acr_values parameter.

• SAML requests use the AuthnContextClassRef element.

These parameters to allow you to initiate step-up authentication, but also to request a specific assurance level during the first authentication.

The OIDC relying party (RP) or SAML service provider (SP) then uses the assurance level in the response to determine which resources the user is authorized to access, based on the assurance level that the authentication method provides.

Supported types of assurance levels

The OneWelcome Identity Platform supports the following types of assurance levels:

• Special purpose assurance levels: These are assurance levels that have special and well-defined functionality in the platform:

  • Authentication journey selection: Use these assurance levels to select a specific authentication journey. Each authentication journey has a unique identifier. Each authentication method in an authentication journey can specify the assurance level that the user attains when they authenticate successfully with that method.

  The reserved assurance level for authentication journeys is: urn:onewelcome:ujo:v1:auth:journey:id.

  For example: urn:onewelcome:ujo:v1:auth:journey:id:3c1bd2cd-d3b9-4e9b-9b1f-afc6ec8fab57.

  • IDP selection: Use these assurance levels to select an identity provider (IDP) in the Identity Broker service, such as: urn:onewelcome:broker:v1:apple:auth. You can specify the required assurance level for each IDP variant.

• Custom assurance levels: You can add your own assurance levels. Custom assurance levels cannot start with urn:onewelcome.

Default assurance levels

Assurance levels can vary based on the combination of authentication methods that are used and the strength of each method.

You can configure the default assurance levels for the following:

• Web clients (Default ACR value)

• SAML applications (Default Authentication Context Class References).

Both of these can include multiple assurance levels.