title: Can someone explain ACR return values in OIDC?
body: <p><em>See bottom for final questions</em> </p>
  
  <p>So I understand the basic concept of the acr value. I know it "specifies a set of business rules that authentications are being requested to satisfy. These rules can often be satisfied by using a number of different specific authentication methods, either singly or in combination." </p>
  
  <p>However I am confused on the return value. I know that if I request in the scope of response an acr claim (as an essential claim) I have to specify the values parameter for a specific authentication context class reference. </p>
  
  <p>This is where I get confused. When I looked for acr return values (the authentication context class reference) I found a number of different LOA profiles I could reference (<a href="https://www.iana.org/assignments/loa-profiles/loa-profiles.xhtml" rel="noreferrer">https://www.iana.org/assignments/loa-profiles/loa-profiles.xhtml</a>). However, only one profile seemed to be referenced in the OIDC documents (and is related to the US) -- InCommon. </p>
  
  <p>When I searched InCommon's website, it is unclear to me if the IdP is required to be certified with InCommon, to return an ACR value. </p>
  
  <p>The following excerpt is from InCommon's website: </p>
  
  <p><em>"How Does it Work?
  The InCommon community has developed and published the Bronze and Silver profiles, which define the specific criteria an Identity Provider must meet to become certified. An Identity Provider incorporates these criteria into its identity and access management system. 
  In the case of Bronze, the Identity Provider can either conduct an audit to prove compliance with the profile or can simply sign a statement (self-assert) that it meets the criteria. 
  Silver requires an audit, which can typically be done by an internal auditor not directly associated with the IT operation."</em></p>
  
  <hr>
  
  <p>I am also confused on how the return value works since the OIDC documentation gives an example "return" value for acr as: </p>
  
  <p>"acr": {"values": ["urn:mace:incommon:iap:silver"]}</p>
  
  <p>Yet, when I look at the acr return value example on Microsoft's Website, it gives an acr return value of 0.</p>
  
  <p>"acr": "0"</p>
  
  <hr>
  
  <p><strong><em>So my final questions: 
  1. Can someone please explain if an IdP (providing a token) is required to be certified to provide an acr return value. 
  2. Is the return value "incommon:iap:silver" or "0"?</em></strong> </p>