Include claim in id_token when MFA was used?

Get Help
, ,
2

Hi @martin.pain
When a user uses MFA to authenticate, the ID Token will have an amr (authentication method reference) claim in the payload with an mfa value in it. Note that amr is an array and there could be other possible values in the future, so the check should be something like:

mfaUsed = payload.amr && payload.amr.indexOf('mfa') >= 0;

This is a sample ID token payload with MFA used:

{
  "iss": "https://nico-sabena.auth0.com/",
  "sub": "xxxxxxxx",
  "aud": "xxxxxxxx",
  "iat": 1540342205,
  "exp": 1540345805,
  "acr": "http://schemas.openid.net/pape/policies/2007/06/multi-factor",
  "amr": [
    "mfa"
  ],
  "nonce": "nonce"
}

Take a look at Step-up authentication for details on this exact scenario.