Testing ACR & AMR with Salesforce

See how Salesforce reacts to different authentication context classes and methods by giving each persona its own ACR and AMR values.

Prerequisites

Complete the Salesforce SSO setup guide first. You need a working SSO login before testing ACR/AMR.

1. Set ACR & AMR on personas

In your realm's directory, edit a persona.
Set ACR to a context class URI, e.g.:
- urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport — password over TLS
- urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract — mobile 2FA
Set AMR to one or more methods, e.g. pwd, otp, mfa.
Create a second persona with different ACR/AMR values so you can compare.

2. Log in with each persona

Trigger SSO from Salesforce and pick the first persona.
Check whether Salesforce accepted the login, and look at the login history (Setup → Login History) for the authentication method recorded.
Repeat with the second persona and compare.

3. What to look for

Does Salesforce enforce a minimum ACR, or does it accept anything?
Are AMR values reflected anywhere in the login history or session info?
What happens when you send an ACR that Salesforce doesn't recognize?

start testing →