Use Case – Strong authentication

  • The configuration for strong-app is identical to the configuration for weak-app:
  • REST target application configuration requires a new Target Application strong-app.
    The authentication flow must require multi-factor authentication and set the corresponding tags.
  • The configuration requires an ACR to Flow Application ID Mapping for strong-acr and a Flow Condition Based OIDC ID Token ACR Value plugin that matches the tag set by the authentication flow.
  • Loginapp UI configuration requires an Authentication & Authorization UI,

Using the strong-app example

Authorize call
  1. Expected behaviour:
  2. Use the above URL in a browser. This is required since the Loginapp UI configured depends heavily on javascript and without browser it will not be rendered.
  3. The login screen will be shown – enter username and password.
  4. The second login screen is shown – enter mTAN code.
  5. If local consents are configured, the consent screen is shown.
  6. The authorization server will now respond with a 302 status code and provide a location parameter with URL, the authorization code and the state parameter on this URL.

Depending on your configuration, this may lead to an error in the browser, if the location cannot be resolved. If you look at the network tab in your browser's developer tools, you will find the redirect URL you are looking for.

Finding the redirect URL


Use the code provided in this location parameter to exchange the authentication code for access and refresh tokens:

Redirect URL to weak-app

    Content-Type: application/x-www-form-urlencoded
    Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ


In the response there will also be an ID token. Due to the roles to ACR mapping, the acquired role strong-role will be mapped to the strong-acr ACR value and returned in the ID token.

ID token from response

    "sub": "mike",
    "aud": "oidcConformance_clientId",
    "acr": "strong-acr",
    "roles": [
    "auth_time": 1598100981,
    "iss": "",
    "exp": 1598101107,
    "iat": 1598100987,
    "family_name": "Doe"