SURFsecureID uses Levels of Assurance (LoA) to express the strength of authentication. This page describes how a service or institution can request a LoA for a specific service or part of a service. Furthermore, the LoA identifiers differ between the environments and between the authentication method used.
How to request a Level of Assurance?
A service can communicate the required LoA to the SURFsecureID gateway and verify the strength at which a user was authenticated.
There are three scenarios how to request a LoA, explained below. They can be combined: the gateway will use the scenario having the highest LoA.
1. Minimum LoA specified by the institution (static)
The institution requires, for a specific SP, its users always to be authenticated at a certain minimum LoA.
The institution must ask SURFnet to set this minimum. SURFnet will configure this on the SURFsecureID gateway.
2. Minimum LoA specified by SP (static)
The SP requires always a certain minimum LoA.
The SP must ask SURFnet to set this minimum. SURFnet will configure this on the SURFsecureID gateway.
3. LoA defined during authentication (dynamic)
A SP can request authentication at a certain LoA by specifying it in the SAML
AuthnRequest. The SP can send this request to the gateway at any time, also when a user is already logged in. This makes it possible to raise the LoA for a user depending on the context, e.g. if the user wants to enter the admin part of the site.
The LoA is passed to the SURFsecureID gateway in an
AuthnContextClassRef element in a
RequestedAuthnContext element in the SAML
The requested LoA is interpreted as a minimum. The SURFsecureID gateway:
- Will not perform authentication below the requested loA.
- May perform authentication at a higher level, in which case the higher level LoA will be expressed in the returned SAML
The actual method of authentication itself (e.g. SMS + password) is not communicated!
- The SURFsecureID gateway will report the SP the actual LoA at which authentication was performed. This is done with the AuthnContextClassRef element of AuthenticationContext in the SAML Assertion in the SAML response.
Standard Authentication LoA's
When using the standard authentication with SURFsecureID, four levels of assurance (LoA) are supported:
- LoA 1: Only password authentication at the institution's IDP
- LoA 1.5: LoA 1 +
- LoA 2: LoA 1 + SMS, Tiqr or AzureMFA authentication
- LoA 3: LoA 1 + YubiKey or FIDO2 (hardware token) authentication
Each LoA is assigned to an identifier and is different for each type of environment used:
AuthnRequest. See SAML message examples for an example
AuthnRequestthat requests authentication at a specific LoA.
- Level 3: YubiKey or FIDO2 (hardware token) authentication