What is the difference between Authentication Level and Authentication Context in ForgeRock AM?

Authentication Level and Authentication Context Class Reference (ACR) are two related but distinct ways ForgeRock AM classifies the strength of an authentication event. Both are recorded in the session and in tokens, and both can be used in access policies and step-up authentication flows. They come from different standardisation traditions.

Authentication Level (AuthLevel) is ForgeRock AM's proprietary numeric scale for measuring authentication strength. Each authentication tree or legacy module is assigned a numeric level. A password-only login might be level 1; TOTP adds another level to reach 2; a hardware key might assign level 3. When an application requests a protected resource, the policy condition can require AuthLevel >= 2, triggering step-up if the current session only has level 1. AuthLevel is a coarse integer scale that AM has used since the OpenAM days.

Authentication Context (acr) is the standardised OAuth2/OIDC mechanism for expressing the same concept. The acr (Authentication Context Class Reference) claim in an ID token is a string that describes the authentication method used — for example urn:mace:incommon:iap:silver or a custom string like urn:example:mfa. Applications can request a specific ACR value via the acr_values parameter in the authorization request, and ForgeRock AM will use the appropriate authentication tree mapped to that ACR value.

In ForgeRock AM, ACR values are mapped to authentication trees in the OAuth2 provider configuration. When a client sends acr_values=urn:example:mfa, AM runs the tree mapped to that ACR value and returns the achieved acr in the ID token. This is the OIDC-standard way of expressing step-up requirements and is preferred for interoperable applications over the proprietary AuthLevel mechanism.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.