SAML QoA Specification
Previously, application owners had to select the exact authentication methods (password, mTAN, AuthApp, Vasco, Kerberos, Smartcard, Mobile ID, FIDO security key) that the user could use to access the application.With the new QoA concept, the corresponding QoA class can be specified directly in the SAML "authnRequest", thus opening up the possibility of presenting the user with all authentication methods that at least correspond to this QoA level.
The information regarding the QoA concept can be found at: Quality of Authentication (QoA)
eIAM "AuthnContextClasses"
These are the new "AuthnContextClasses" to request authentication of a user:| Authentication Level | AuthnContextClasses |
|---|---|
| QoA10 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:10 |
| QoA20 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:20 |
| QoA30 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:30 |
| QoA40 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:40 |
| QoA50 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:50 |
| QoA51 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:51 |
| QoA60 | urn:qoa.eiam.admin.ch:names:tc:ac:classes:60 |
Example of an SAML authentication request "authnRequest"
SAML authentication request "authnRequest"
To request a specific QoA level in a SAML authnRequest, one needs to add an AuthnContextClassRef (lines 26 to 30 in the example above) to the request. We consider the requested QoA level as the minimum. If the user reaches a higher level, we accept it and inform the application in the response.
Example of "SAML-Response"
SAML Response