OAuth 2.0 and OIDC

---

Triggering IAL2 Verification Using OAuth 2.0 and OIDC

Users can upgrade their own status to IAL2 in AdminX by using the 1Kosmos web-based identity-proofing flow. Tenant and community administrators can trigger this flow using OpenID Connect (OIDC) ACR claims.

Prerequisites

• A configured OIDC application in AdminX.

Before starting, ensure you have configured an OIDC application for SSO. See OIDC Integration in AdminX for more information.

To view your OIDC application settings:

1. Navigate to your AdminX portal and log in as a tenant or community administrator.

2. Go to the Applications page and find your OIDC application.

3. Click the pencil icon under Actions to view the OIDC application settings.

Your Client ID and Client Secret can be viewed and copied from this screen.

Fetch Current IAL Using Custom Scope

Your current IAL can be requested using the /assurance/ial/2 custom scope, as shown below:

https://blockid-trial.1kosmos.net/oauth2/community/default/v1/authorize
  ?response_type=code
  &client_id=ae0456c92ac24f0ace200f103ab93c81
  &scope=email openid /assurance/ial/2
  &redirect_uri=https://google.com
  &state=123

The OIDC response returned by the server contains the user's current IAL, located in the amr parameter.

Requesting IAL2 Step-Up Verification

Using Custom Scope

IAL2 step-up verification can be requested using the /assurance/ial/2 custom scope in your request, as shown below:

https://blockid-trial.1kosmos.net/oauth2/community/default/v1/authorize
  ?response_type=code
  &client_id=ae0456c92ac24f0ace200f103ab000000
  &scope=openid /assurance/ial/2
  &redirect_uri=https://google.com
  &state=123

Response payload:

{
  "sub": "1PJ8RjLctvisMZvADuKNp",
  "ial": "IAL2",
  "acr": "/assurance/ial/2/",
  "amr": [
    "IAL2"
  ],
  "at_hash": "zYYYvMoJBs9v4kOhiyt000",
  "aud": "33724c7d05e452695658af5a38500000",
  "exp": 1680079821,
  "iat": 1680076221,
  "iss": "https://blockid-trial.1kosmos.net/oauth2/community/default"
}

From a user's standpoint, they are redirected to AdminX to perform their step-up identity verification instead of a standard login. Once the identity verification is completed, the user is at IAL2.

Using ACR Claims

IAL2 step-up verification can also be requested using ACR Claims, as shown below:

<authorize_endpoint>
  ?response=...
  &client_id=...
  &scope=...
  &redirect_uri=...
  &state=...
  &claims={ "id_token": { "acr": { "values": ["/assurance/ial/2/"] } } }

From a user's standpoint, they are redirected to AdminX to perform their identity verification instead of a standard login. Once the identity verification is completed, the user is at IAL2.

OIDC Responses

Depending on the user's current IAL level after performing their identity verification, the server returns different responses. The table below shows the OIDC responses returned after a user has attempted an identity verification.

Requested AuthnContext	User's IAL Level After Identity Verification	OIDC Response
IAL2	IAL1 (Failed Identity Verification or Insufficient Information)	{ "acr": "/assurance/ial/2/", "amr": [] }
IAL2	IAL2	{ "acr": "/assurance/ial/2/", "amr": ["IAL2"] }
IAL2	IAL3	{ "acr": "/assurance/ial/2/", "amr": ["IAL2","IAL3"] }