SAML QoA Specification

Previously, application owners had to select the exact authentication methods (password, mTAN, AuthApp, Vasco, Kerberos, Smartcard, Mobile ID, FIDO security key) that the user could use to access the application.

With the new QoA concept, the corresponding QoA class can be specified directly in the SAML "authnRequest", thus opening up the possibility of presenting the user with all authentication methods that at least correspond to this QoA level.

The information regarding the QoA concept can be found at: Quality of Authentication (QoA)

eIAM "AuthnContextClasses"

These are the new "AuthnContextClasses" to request authentication of a user:

Authentication Level
AuthnContextClasses
QoA10
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:10
QoA20
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:20
QoA30
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:30
QoA40
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:40
QoA50
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:50
QoA51
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:51
QoA60
 urn:qoa.eiam.admin.ch:names:tc:ac:classes:60

Example of an SAML authentication request "authnRequest"


To request a specific QoA level in a SAML authnRequest, one needs to add an AuthnContextClassRef (lines 26 to 30 in the example above) to the request. We consider the requested QoA level as the minimum. If the user reaches a higher level, we accept it and inform the application in the response.

Example of "SAML-Response"