OIDC4AC: Extending OpenID Connect for Structured and Negotiable Authentication Contexts

Abstract

OpenID Connect (OIDC) is a widely adopted authentication protocol on the web. Despite its popularity, it provides limited expressiveness for describing how users are authenticated, constraining its applicability in highassurance, auditable scenarios. To understand the extent of this gap, a Multivocal Literature Review was conducted, revealing the absence of an integrated, OIDC-native model for representing factors and specifying authentication requirements. To address these gaps, this paper proposes OpenID Connect for Authentication Context (OIDC4AC), a new OIDC protocol extension that enables fine-grained specification and detailed representation of authentication factors, improving interoperability and auditability.