RFC 9470 — Step-Up Authentication

Specification: RFC 9470

Step-Up Authentication allows resource servers to request additional authentication when a user needs elevated privileges for sensitive operations.

WWW-Authenticate Challenge

• insufficient_user_authentication error
• acr_values parameter in challenge — request specific authentication context
• max_age parameter in challenge — require recent authentication

Authorization Request

• acr_values parameter — requested authentication context class
• max_age parameter — maximum authentication age

ID Token Claims

• acr claim — Authentication Context Class Reference
• auth_time claim — time of authentication

Use Cases

Step-up authentication enables:

• Re-authentication before sensitive operations (delete account, change password)
• MFA challenges for high-risk transactions
• Time-based re-authentication requirements