OIDC Parameters

This topic defines the OpenID Connect (OIDC) parameters supported by FortiIdentity Cloud:

• AMR/ARC Handling
• Dynamic Prompt Handling
• OAuth2 Standard Error Responses

These are default parameters and cannot be configured.

AMR/ACR Handling

FIC processes Authentication Method Reference (AMR) and Authentication Context Class Reference (ACR) values from OIDC claims in order to determine the required authentication methods.

When a client requests authentication with claims containing acr or amr in the id_token claim, FIC performs the following actions:

1. FIC determines the authentication method from the requested ACR/AMR and cross-checks it against the authentication methods configured in FIC.
2. The end-user can choose from the subset of the allowed methods. If there is no available subset of allowed methods, the authentication will fail.
3. FIC then returns the appropriate ACR value in the ID token.

ACR Mapping

The following table shows the default ACR mapping per application:

ACR	Mapped application
forti:mfa:any	SMS, Email, FTM, FTK, WebAuthn
forti:mfa:code	SMS, Email, FTM
forti:mfa:key	FTM, FTK
forti:webauthn	WebAuthn

AMR Values

FIC supports standard AMR values and maps them to the following authentication methods:

AMR	Mapped authentication methods
otp	SMS, Email, FTM
sms	SMS
swk	FTM (Soft token)
hwk	FTK (Hardware token)
fido	WebAuthn
pwd	Password
mfa	SMS, Email, FTM, WebAuthn

Dynamic Prompt Handling

During the authorization flow, FIC processes the prompt parameter dynamically.

Supported Prompt Values

The following prompt parameters are supported in FIC:

Supported Prompt Values	Details
login	Forces re-authentication.
none	Requires an existing valid session; returns login_required if not authenticated.
consent	Requests consent.

Dynamic Prompt Behavior

• max_age processing: If max_age is provided and the authentication age exceeds it, FIC sets prompt=login.
• Microsoft Entra ID (EAM): For EAM applications without an existing session key, FIC sets prompt=login.
• Session validation: If prompt=none and the user is not authenticated, FIC redirects with login_required.

OAuth2 Standard Error Responses

The authorization endpoint returns OAuth2-compliant error responses when authentication fails or invalid requests are detected.

Error Response Format

Errors are returned as redirects to the redirect_uri with the following query parameters:

Query Parameters	Details
error	Error code
error_description	Human-readable description
state	Original state parameter (if provided)

Supported Error Codes

FIC supports the following error codes:

Error Codes	Details
login_required	Authentication required but not present (when prompt=none).
invalid_request_object	Invalid request parameters (e.g., invalid username).
access_denied	Access denied (e.g., invalid client credentials, invalid redirect URI).
invalid_grant	Invalid or expired authorization code.