dotnet / dotnet/aspnetcore

The amr claim is set incorrectly when authenticating using passkeys

Open
#64,881 0 comments 0 reactions 0 assignees View on GitHub
area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When I authenticate using passkeys, the **amr** claim is returned with a value of **pwd**. This is incorrect.

### Expected Behavior

Using the OpenID spec, the value should be set to: **pop**

https://openid.net/specs/openid-connect-eap-acr-values-1_0-final.html

Older specs:
The value should be "hwk", or "swk" using this:

Spec: https://datatracker.ietf.org/doc/html/rfc8176

### Steps To Reproduce

Create a new ASP.NET Core Blazor app using Identity and authenticate using passkeys

### Exceptions (if any)

_No response_

### .NET Version

.NET 10

### Anything else?

This is important because secure applications must identify the level of authentication.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.