Messages - Do we need three ways of requesting "acr" values?

[Michael Jones]

We currently have 3 ways of requesting "acr" values:

1. The "default_acr_values" registration parameter.

2. The "acr_values" request parameter.

3. The "acr": {"values": ...} claim request.

Which of these should we keep?

[Brian Campbell]

Seems like too many ways. Some kind of support for the "step up" use case is needed but one way is probably enough.

[Michael Jones]

We could eliminate 2 if every trust framework using ACRs mandated support for requesting the "acr" claim in the "claims" request parameter.

[Michael Jones]

We will possibly reconsider this after more implementation experience.

[Michael Jones]

There are reasons for all the methods in the spec. There isn't consensus to remove any of them.

John said that there are privacy reasons to want to be able to request "acr" as an essential claim and return an error if it fails.