Open andremussche opened 11 months ago
Just for my understanding, Microsoft offers two ways to do OIDC sign-in, v1 and v2.
And you need the mfa
parameter to check for "special admin functionality", and that is not present in the current implementation that uses v2.
Did I get it right? Found this v1/v2 distinction very confusing, do you have materials from MS for this version difference by any chance?
Yes that's right, only V1 does support de "mfa" parameter and has the "amr" claim in de ID token, but V2 does not:
This is also stated here in this answer: https://learn.microsoft.com/en-us/answers/questions/953276/is-there-an-option-to-add-an-optional-oidc-claim-a
A little bit confusing is this page (https://learn.microsoft.com/en-us/azure/active-directory/develop/access-token-claims-reference) because the V1 has no JWT access tokens (in my test) but the "amr" is indeed only in V1 ID token ("only present in v1.0 tokens"). Note: V2 has "amr" in the access token (jwt) but not in the id token, and you cannot ask V2 for MFA so it is rather useless.
Preflight checklist
Ory Network Project
No response
Describe your problem
Our customer wants to extend the use of Office365 SSO with an optional MFA check for special admin functionality. This can be done using the "amr_values" parameter (e.g. "ngcmfa" or "mfa"):
However, this parameter cannot be used with the default Microsoft provider in Kratos because it uses V2 and not V1:
Note: the customer doesn't want to include personal accounts so V2 is not mandatory, V1 support should be enough.
When I try to use the Generic provider instead, I get a Kratos error:
Describe your ideal solution
Also support the V1 endpoints, besides the normal "microsoft" V2 provider.
Note: this includes the same not-so-oidc-compliant dynamic tenant parameter workaround:
Also extend the "upstream_parameters" struct with "amr_values" (or pass any parameter):
Workarounds or alternatives
None: generic provider could not be used because of changing tenant issuer
Version
oryd/kratos:v1.0
Additional Context
No response