Introduction

The Quality of Authentication Registration (QoR) defines how confident we are in the subject to be who he claims to be. If he simply registered without any verification steps, he has a low QoR / LoR. If we verified his identity against a third party system or by manually checking his passport, a higher QoR can be issued.

...

Within the configuration, you can define which verification methods have to be passed, for which quality of authentication. There is an option to AND or OR combine various methods. Whenever there is an OR combination, a selection will be presented to the user, so that he can choose his preferred method. Below is a visual sample configuration:

...

Image Added

Depending on the configured or requested QoA QoR by the application - or implicitly by the requested Level of Trust - the user has to fulfill no verification (QoA1QoR1), fulfill either the manual identification or video identification method (QoA2QoR2) or the requirements from QoA2 QoR2 and the API verification method (QoA3QoR3).

QoR Claims

In the id_token you will get a list of QoA’s QoR’s the the user has passed in the fulfilled_qors claim.

Note: This is independent from the arm_values which only contains the passed LoT and QoR definitions requested by the current application. A user could login with a QoA1 to your application, but also would have passed QoA2. Since this was not requested by the application, it's not passed into the arm_values but into the fulfilled_qors.

Configuration

There is currently no configuration user interface for this. The configuration is linked to the Level of Trust and stored in the servicecorelogin_quality_of_registration table. There you can define different QualityOfRegistrationSteps which have to match the documented enum below. In upcoming versions there will be a user interface for this configuration.

Up to v9.0.3

public enum QualityOfRegistrationSteps
{
    Dummy, //0
    None, //1
    AutoOrManual, //2
    AutoOrManualAndAhv, //3
}

As of v9.1.0

public enum QualityOfRegistrationSteps
{
    Dummy, //0
    None, //1
    AutoOrManual, //2
    AutoOrManualAndAhv, //3
    Auto, //4
    AutoAndAhv //5
}

Meaning of Auto: Self-Registration on a mobile phone using a browser-guided process controlled by fidentity.

Meaning of Manual: Manual registration at a government agency based on a pre-printed form which includes a 2D barcode (HTTPS Link).

Meaning of AutoOrManualAndAHV: To achieve this QoR, you have to achieve: ( (“Auto” or “Manual”) AND AHV-Check )

For example: if you want only None, Auto and AutoAndAhv your servicecorelogin_quality_of_registration needs only 3 rows with the steps 1, 4 and 5.