OpenID Connect Core Error Code unmet_authentication_requirements#

This section contains the implementation of OpenID Connect Core Error Code unmet_authentication_requirements. The authorization server returns this error when it cannot authenticate the user as the client requires, for instance with the acr_values parameter.

Per this specification, the server SHALL return this error when the claims parameter requests an essential acr that it cannot meet. Register UnmetAuthenticationRequirements on the authorization server to return it in this case:

from authlib.oidc.unmet_authentication_requirements import (
    UnmetAuthenticationRequirements,
)

authorization_server.register_extension(UnmetAuthenticationRequirements())

Without this extension, Authlib refuses this request with access_denied. To refuse other requests, such as an acr_values that the authentication does not satisfy, raise UnmetAuthenticationRequirementsError from get_acr of the authorization session, see Authorization Session. The error is redirected to the client.

API Reference#

class authlib.oidc.unmet_authentication_requirements.UnmetAuthenticationRequirements#

Authorization server extension for OpenID Connect Core Error Code unmet_authentication_requirements:

authorization_server.register_extension(UnmetAuthenticationRequirements())

When the claims parameter requests an essential acr with values, and the acr that the authorization session returns is not one of them, the request is refused with unmet_authentication_requirements instead of access_denied. Per this specification, the server SHALL use this error in this case. The error is redirected to the client.

It needs ClaimsParameter, and an authorization session that inherits AuthorizationSessionMixin. With the openid scope, get_acr of the session raises the error itself, also when the application calls it.

register_grant_hooks(authorization_server, grant)#

Check the acr of the authorization session of the grant.

Parameters:

  • authorization_server – The authorization server.

  • grant – The grant of the authorization request.

register_session_hooks(grant)#

Check the acr that get_acr returns, once the authorization session is attached to the grant. When get_acr cannot be hooked, for instance when a plain class defines it next to AuthorizationSessionMixin, it is not checked, and the error stays access_denied.

Parameters:

grant – The grant of the authorization request.

validate_acr(session, get_acr, request)#

Return the acr of the authorization session, or refuse an essential acr that it does not satisfy.

Parameters:

  • session – The authorization session.

  • get_acr – The get_acr method of the session.

  • request – The authorization request.

Raises:

UnmetAuthenticationRequirementsError – if the claims parameter requests an essential acr that is not met

class authlib.oidc.unmet_authentication_requirements.UnmetAuthenticationRequirementsError(description=None, uri=None, status_code=None, state=None, redirect_uri=None, redirect_fragment=False, error=None)#

The Authorization Server is unable to meet the requirements of the Relying Party for the authentication of the End-User.

https://openid.net/specs/openid-connect-unmet-authentication-requirements-1_0.html#rfc.section.1