Use Case – Strong authentication

The configuration for strong-app is identical to the configuration for weak-app:

  • REST target application configuration requires a new Target Application "strong-app".
    • The authentication flow must require multi-factor authentication and set the corresponding tags.
  • AS-centric AS configuration requires an ACR to Flow Application ID Mapping for "strong-acr" and a Flow Condition Based OIDC ID Token ACR Value plugin that matches the tag set by the authentication flow.
  • Loginapp REST UI configuration requires an Authentication & Authorization UI,

Using the strong-app example

AS-centric AS - authorize call

Expected behaviour:

  1. Use the above URL in a browser. This is required since the REST UI configured depends heavily on javascript and without browser it will not be rendered.
  2. The login screen will be shown - enter username and password.
  3. The second login screen is shown - enter mTAN code.
  4. If local consents are configured, the consent screen is shown.
  5. The authorization server will now respond with a 302 status code and provide a location parameter with URL, the authorization code and the state parameter on this URL.

Depending on your configuration, this may lead to an error in the browser, if the location cannot be resolved. If you look at the network tab in the developer tools of your browser, you will find the redirect URL that you are looking for.

AS-centric AS - redirect


Use the code provided in this location parameter to exchange the authentication code for access and refresh tokens:

AS-centric AS - redirect URL to weak-app

    Content-Type: application/x-www-form-urlencoded
    Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ


In the response there will also be an ID token. Due to the roles to ACR mapping, the acquired role "strong-role" will be mapped to the "strong-acr" ACR value and returned in the ID token.

AS-centric AS - ID token from response

    "sub": "mike",
    "aud": "oidcConformance_clientId",
    "acr": "strong-acr",
    "roles": [
    "auth_time": 1598100981,
    "iss": "",
    "exp": 1598101107,
    "iat": 1598100987,
    "family_name": "Doujak"