What is the difference between Authentication Level and Authentication Context in ForgeRock AM?

Authentication Level and Authentication Context Class Reference (ACR) are two related but distinct ways ForgeRock AM classifies the strength of an authentication event. Both are recorded in the session and in tokens, and both can be used in access policies and step-up authentication flows. They come from different standardisation traditions.

Authentication Level (AuthLevel) is ForgeRock AM's proprietary numeric scale for measuring authentication strength. Each authentication tree or legacy module is assigned a numeric level. A password-only login might be level 1; TOTP adds another level to reach 2; a hardware key might assign level 3. When an application requests a protected resource, the policy condition can require AuthLevel >= 2, triggering step-up if the current session only has level 1. AuthLevel is a coarse integer scale that AM has used since the OpenAM days.

Authentication Context (acr) is the standardised OAuth2/OIDC mechanism for expressing the same concept. The acr (Authentication Context Class Reference) claim in an ID token is a string that describes the authentication method used — for example urn:mace:incommon:iap:silver or a custom string like urn:example:mfa. Applications can request a specific ACR value via the acr_values parameter in the authorization request, and ForgeRock AM will use the appropriate authentication tree mapped to that ACR value.

In ForgeRock AM, ACR values are mapped to authentication trees in the OAuth2 provider configuration. When a client sends acr_values=urn:example:mfa, AM runs the tree mapped to that ACR value and returns the achieved acr in the ID token. This is the OIDC-standard way of expressing step-up requirements and is preferred for interoperable applications over the proprietary AuthLevel mechanism.