RFC 9470 — Step-Up Authentication — Versola Docs
/docs
Pre-1.00.7.5versola.ioGitHub
RUEN

RFC 9470 — Step-Up Authentication

OAuth 2.0 Step-Up Authentication Challenge Protocol — how edge challenges a caller and how auth honours acr_values and max_age.

Specification: RFC 9470

Step-Up Authentication lets a resource server demand a stronger or fresher authentication for a sensitive operation. In Versola the resource server role is played by edge, which evaluates the step-up rules of each resource endpoint and answers with the challenge.

Status

Implemented. Checked claims: 10 of 12.

WWW-Authenticate challenge (from edge)

  • error="insufficient_user_authentication"
  • acr_values in the challenge — the ACR the endpoint requires, when the token’s acr does not satisfy it
  • max_age in the challenge — when the token’s auth_time is older than the endpoint’s limit
  • An unevaluable step-up condition is read as “step-up required”; a broken rule is a 500
  • The challenge scheme follows the token — edge always answers with Bearer, including for a DPoP-bound token

Authorization request (from auth)

  • acr_values — requested authentication context; a value neither the tenant nor Versola defines is dropped, one that cannot be met for the user is refused
  • sensitive — a class Versola defines itself: the strongest factor the user has (a passkey, else a password, else a one-time code, limited to what the client’s flow can ask), checked against what the session already passed
  • max_age — a session older than the limit forces re-authentication, and tokens carry over only if the same user signs in again

Token claims

  • acr — in the ID token and in access tokens
  • auth_time — in the ID token and in access tokens
  • amr — in the ID token and in access tokens

Metadata

  • acr_values_supported — not in the generated discovery document

Notes

  • Step-up rules are set per endpoint in the admin console under Resources: a CEL condition, the required acr and a maximum authentication age. See Edge policies.
  • sensitive is not listed in a tenant’s ACR vocabulary: which factor it needs depends on the user, and a vocabulary entry is the same for everyone. A one-time code never stands in for a passkey or a password the user has enrolled; a user whose flow cannot ask for the factor they have is refused with unmet_authentication_requirements. A tenant that defines sensitive in its own vocabulary overrides it. It does not make a sign-in fresher by itself: pair it with a maximum authentication age on the endpoint.

Where to look

Endpoint policies explain how to set stepUpAcr, maxAge and stepUpCondition on a resource endpoint.