Allow acr_values to be configured

[DanielBrierton]

Important

Why are we doing this?

We're in the process of rebuilding profile into a Rails app and are making an attempt to better align with OIDC standards. We currently misuse scopes to restrict whether unverified or supervised (u13) accounts can log in to a given app. Scopes should, however, only deal with authorisation and not authentication. acr_values instead should be provided for this purpose.

What we need to do

• Update openid_connect_options in lib/rpi_auth/engine.rb to include acr_values from RpiAuth.configuration
• Update docs to include information on how to require that a user is verified, can login a supervised account and has parental consent
  • README.md in this repo
  • documentation repo
• Bump minor version as this is a non-breaking change
• Write tests
• Release new version
• Communicate change to teams

Acceptance criteria

Feature: …
As a …
I want to …
So that ….

Scenario: …

Given I provide acr_values to rpi_auth
When I log in using it
Then the acr_values are passed to the OIDC provider

References

• rpf-accounts issue
• OpenID Connect Core 1.0 — acr_values request parameter
• OpenID Connect Core 1.0 — acr claim (ID Token)
• OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0

Notes

Open questions

• Do we need to allow dynamic acr_values through a setup lambda? (like suggested in Add support for OIDC-compliant param to trigger signup flow #98