Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p22
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 77641–80877

URI MUST match exactly one of the Redirection URIs preregistered at the IXP. The URI MUST follow the schemes outlined in section 1.4 of this Schedule.
       * state

            * REQUIRED. Un-guessable random string generated by the client used to protect against CSRF attacks. MUST contain sufficient entropy to avoid guessing and is returned to the Client in the authentication response.
       * prompt
                + OPTIONAL. A space delimited, case sensitive list of string values that specifies if the authorisation server prompts for the End-User to re-authenticate or provide consent. Defined values that a IXP MUST support are:
                        o none: The authorisation server MUST NOT display any authentication or consent user interface pages. An error is returned if the End-User is not already authenticated or not already provided consent for the requested claims or does not fulfil any other conditions for processing the request.
                         o login: The authorisation server MAY prompt the End-User for reauthentication.
                        o consent: The authorisation server MAY prompt the end user for consent before returning information to the client. Consent should be requested in accordance with the attribute sharing policies defined in Schedule 3 (AGDIS Attribute Profile).
                         o select_account: The authorisation server MAY prompt the End-User to select a user account. This allows an end user with multiple accounts at the authorisation server to select amongst their accounts that currently have an active session at the authorisation server.
       * display
                + OPTIONAL. A string value that specifies how the authorisation server displays the authentication and consent interface pages to the End-User.
                         o page: The authorisation server SHOULD display the authentication and consent user interface consistent with a full User Agent page view. This is the default where the display parameter is not specified.
                         o popup: The authorisation server MAY display the authentication and consent user interface consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.
                         o touch: The authorisation server MAY display the authentication and consent user interface consistent with a device that leverages a touch interface.
                        o wap: The authorisation server MAY display the authentication and consent user interface consistent with a "feature phone" type display.
       * nonce
                + REQUIRED. Un-guessable random string generated by the client, used to protect against cross site request forgery attacks. MUST contain sufficient entropy to avoid guessing. Returned to the client in the ID Token.
       * acr_values
                + OPTIONAL. A TRP may specify the required level(s) of assurance here. For permissible ACR values see section 1.9.3 of this Schedule.
       * code_challenge and code_challenge_method
                + OPTIONAL. If an IXP supports PKCE as described in section 1.2.2