When requesting authentication from the HIN broker, the client system (service provider) can specify the required authentication security level. This is enforced by the IDP during the end-user's authentication. The desired level can be specified in the SAML authentication request using the “Authentication Context Class Reference.”
The lowest level is authentication with a username and password - or single-factor authentication. This level is reached when users work in institutions with HIN Access Gateway and have not linked their local Windows account to an HIN identity. In other words, users access the service provider using a device or team identity, but not a personal identity.
Example of the authentication context in SAML:
<samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef>https://hin.ch/profile/pwd</saml:AuthnContextClassRef></samlp:RequestedAuthnContext>
For a higher authentication level, the value https://hin.ch/profile/mfa is available.
Do you have any further questions?
Please contact us if your question could not be answered.