Customize session.amr Dynamic Authentication Context in Okta to Send Custom Values

Downstream application requirements sometimes dictate sending a single-value authentication context or a customized set of values. Because Okta includes all applicable authentication methods when multi-factor authentication is present by default, administrators cannot directly alter the multi-value output generated by the session.amr variable. Configure a custom Security Assertion Markup Language (SAML) application with a custom attribute statement and hardcoded values to override the default behavior and send a single-value authentication context.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Single Sign-On (SSO)
• Security Assertion Markup Language (SAML) 2.0 Applications
• Dynamic Authentication Context
• session.amr

As per RFC8176, Okta includes all applicable authentication methods when multi-factor authentication is present. Administrators cannot directly alter the default multi-value output generated by the session.amr variable. For example, when authenticating with a password and Okta Verify Push as a second factor, Okta generates a multi-value context by default.

<saml:Attribute Name="amr" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
    <saml:AttributeValue xsi:type="xs:string">pwd</saml:AttributeValue>
    <saml:AttributeValue xsi:type="xs:string">mfa</saml:AttributeValue>
    <saml:AttributeValue xsi:type="xs:string">swk</saml:AttributeValue>
</saml:Attribute>

How is a custom SAML attribute statement configured?

Administrators cannot modify the behavior of session.amr, but they can override the value sent to the service provider by configuring a custom SAML application and a custom SAML attribute statement with hardcoded values. Navigate to the application settings in the Okta Admin Console and define a custom attribute statement with a hardcoded string or array expression.

1. In the Okta Admin Console, navigate to Applications > Applications and select the application.
2. Go to the Sign On tab, scroll down to the Attribute Statements section, and expand Show Legacy Configuration.
3. Select Edit.
4. Define a custom attribute statement to send a specific hardcoded string or array of values instead of referencing session.amr:
   • Name: Enter amr (or the attribute name expected by the application).
   • Name Format: Select Unspecified (or as required by the application).
   • Value: Enter a specific hardcoded string (for example, "pwd") or a custom array expression suitable for the application requirements.
5. Select Next, then select Finish to save the changes.

Okta Support can assist with troubleshooting hardcoded values that fail to send.

If an administrator configures a hardcoded value or array in the application configuration, but Okta still does not send the value in the SAML assertion, verify the feature flag status. Review the following considerations to resolve this limitation.

• Contact Okta Support to verify the status of the feature flag that affects this behavior.
• If the feature flag is enabled in the tenant, a known limitation prevents hardcoded values or arrays from rendering in the assertion. Okta Support can evaluate the tenant and disable the feature flag if appropriate.