Skip to content

How to request MFA information during user’s login

MFA login

Besides the user initiated login using Multi-factor Authentication (MFA), services may also request MFA at the login. This may be based on several reasons, like sensitive data or privileges at the service itself.

Request MFA at the login

Helmholtz ID supports the request for MFA during login for OIDC services. This is done according the OIDC standard by adding the acr_values parameter to the authentication request. The most reliable value is https://refeds.org/profile/mfa.

E.g. 

1
https://login.helmholtz.de/oauth2-as/oauth2-authz?response_type=code&client_id=...&redirect_uri=...&scope=...&acr_values=https://refeds.org/profile/mfa

For further information, please read the OpenID Connect Core 1.0 standard.

Need help?

Contact us if you need help.