OAuth 2.0 Step Up Authentication Challenge

The OAuth 2.0 Step Up Authentication Challenge Protocol (RFC 9470, a final IETF standard since September 2023) lets an OAuth 2.0 API tell an application that the user's sign-in behind the current access token is too weak or too old for the request at hand, and what it requires instead, such as multi-factor authentication or a login within the last few minutes. The application then asks the authorization server for exactly that authentication strength or recentness, so high-risk operations can demand stronger assurance without imposing it on every login.

How does it work?

The protocol introduces a new error code value:

  • insufficient_user_authentication: The authentication event associated with the access token presented with the request does not meet the authentication requirements of the protected resource.

It also defines parameters for the WWW-Authenticate response header of the OAuth authentication schemes to convey the authentication requirements back to the client:

  • acr_values: A space-separated string listing the authentication context class reference values in order of preference. The protected resource requires one of these values for the authentication event associated with the access token. The authentication context conveys information about how authentication takes place (e.g., what authentication method(s) or assurance level to meet).
  • max_age: This value indicates the allowable elapsed time in seconds since the last active authentication event associated with the access token. An active authentication event entails a user interacting with the authorization server in response to an authentication prompt.
ClientResource serverAuthorization serverEnd user request, with the token it has 401, acr_values and max_ageauthorization request, acr_valuesauthentication prompttoken carrying acr, auth_timethe same request, accepted
The resource server names the authentication it needs, the client asks the authorization server for exactly that, and the token that comes back carries the proof.

Key Advantages

The OAuth 2.0 Step Up Authentication Challenge Protocol provides the following advantages:

  • Flexibility: Resource servers can require different authentication strengths or freshness according to the characteristics of a request.
  • Security: The protocol provides a mechanism for a client to request that an authorization server achieve a specific authentication strength or recentness when processing an authorization request.

Key Challenges

The OAuth 2.0 Step Up Authentication Challenge Protocol poses the following challenges:

  • Complexity: Resource servers have to define and maintain authentication requirements per resource or operation, and clients have to recognize the challenge, restart authorization, and retry the original request.
  • Compatibility: The protocol requires support from both the resource server and the client.

Relation to Out-of-Band Approval

Step-up assumes the right user is already in the channel and only their authentication needs strengthening or refreshing, so the remedy stays in-band. Where the user is not in the channel at all, or where the pending action needs a decision from a different person (such as a human approving what an autonomous process proposed), the corresponding mechanism is Client-Initiated Backchannel Authentication (CIBA), which requests the authentication server-to-server and has the user approve on a separate registered device.