Quality of Authentication (QoA)

With the specification of the corresponding QoA class in the SAML/OIDC federation protocol, the following advantages result:

• A business application does not have to worry about the complex configuration of the various authentication methods.
  
• It only has to be decided which QoA class is desired or required for the business application to be integrated. By specifying the corresponding QoA class in the federation protocol, it is automatically ensured that the user is offered all permitted authentication methods that at least correspond to this QoA class.
  
• New authentication methods, which are included in the QoA concept, are thus automatically available without having to adapt the application.
  
• The introduction of new authentication methods thus becomes transparent for the business application.
  

IdPs FED-LOGIN/BYOI and QoA (Credentials/Clearance Types)

IdP+Credential(s)+Clearance type = Quality digital identity

For QoA40, 50 & 60, the underlying electronic identity is not simply self-registered, but verified (surname, first name, date of birth, ID type and ID number). Verified electronic identities enable the traceability of who was equipped with it and thus, if necessary, the recourse to these persons.

In which cases must identities with QoA40, 50 and 60 be used?

1. Access to ICT resources of the Federal Administration in an enterprise context (internal and external employees and partners). Minimum requirement: QoA40
2. Access to data with increased protection requirements in the SZ+ and the federal Administration network; minimum requirement according to current zone policy is QoA50, this is only possible with hard crypto tokens such as smartcard, Mobile ID/FIDO with VIPS.
3. Need of the business process to be able to reliably identify the acting person (recourse capability, minimum requirement: QoA40). This case can also be handled by the target application, for example, by uploading a badge copy to the target application

• The login method FED-LOGIN supports QoA40 to 60 for the following target groups.
  Infolink/Instruction
  
  • Internal/external employees who are onboarded by the HR of the Federal Administration or SG-PKI affiliation such as the cantons and equipped with a smartcard (QoA60).
  • Smartcard holders who wish to use their FED-LOG without using their smartcard with a hard crypto token such as the Mobile ID (QoA50).
  • Smartcard holders who want to use their FED-LOG without using their smartcard with a second factor such as mTAN, AuthApp or the Kerberos service (QoA40).
  
  
• The "totally smartcardless" FED-LOGIN login method supports QoA50 for the following target group. Infolink/Instruction
  
  • External employees of the federal administration who do not have a federal smartcard and will not be equipped with one in the near future (e.g. Mobile VDI users), but need to access federal administration resources that require strong authentication. By performing the FED-LOGIN "Totally Smartcardless" upgrade, these employees can upgrade the quality of their identity by going through a video identification process and simultaneously registering a strong authentication means with the Mobile ID (QoA50).
  
  
• The CH-LOGIN login method supports QoA20 to 50. Infolink/Instructions
  
  • The CH-LOGIN should be used by all persons who cannot have a FED-LOGIN. This also applies, among others, to the federal employees of the federal operating institutions (3rd circle in the four-circle model).
  • The CH-LOGIN is also used for holders of a FED-LOGIN if they wish to act outside the business context (private individuals, representatives of the economy). Important: FIDO tokens may only be used here with private ICT devices. The use of ICT devices of the Federal Administration is prohibited!

Detailed information on the SAML QoA Specification
Detailed information on the OIDC QoA Specification
Detailed information about QoA :