OIDC4AC native lab

Relying party test client

Compose an authentication request

Build a valid, nested amr_details Claim Request Object visually, then inspect or edit the exact JSON sent to Keycloak.

Issuer
https://oidc4ac-keycloak.duckdns.org/realms/oidc4ac
Demo user
alice / Alice-password-123
Email inbox
Open smtp4dev

Visual builder

Authentication expression

Method identifiers and property suggestions come from the issuer’s OIDC Discovery document. You may still type an unadvertised value to exercise failure paths.

Loading method and property suggestions from discovery…

Request disclosure in

A logical group can contain factors or further all_of/one_of groups. Sibling order is JSON order, not an instruction telling the OP which authenticator to execute first.

Advanced mode

Claim Request Object

This is the submitted source of truth. You can make independent ID Token and UserInfo projections here. The visual builder supports recursive nested expressions; it loads the first requested delivery projection.

Essentiality

The claim-level switch applies to amr_details. Per-property and time switches are local constraints. Non-essential constraints are best-effort preferences.

Discovery suggestions

Discovery advertising means that the OP understands a method or property; it does not mean it is enrolled or available for the current user or event.

Truthful responses

An OP must omit the whole amr_properties member when it cannot truthfully provide a method profile’s required properties. An essential property may therefore fail generically.