Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p12
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 42014–46925

a minimum level of assurance when making authentication requests.

 Table 1 Level of assurance combinations used in the AGDIS.

Identity proofing level   Authentication level   URN                               Ranking (low to high)
IP1                       AL1                                                      1
                                                 urn:id.gov.au:tdif:acr:ip1:cl1
                          AL2                                                      2
                                                 urn:id.gov.au:tdif:acr:ip1:cl2
                          AL3                                                      3
                                                 urn:id.gov.au:tdif:acr:ip1:cl3
IP1 Plus                  AL1                                                      4
                                                 urn:id.gov.au:tdif:acr:ip1p:cl1
                          AL2                                                      5
                                                 urn:id.gov.au:tdif:acr:ip1p:cl2
                          AL3                                                      6
                                                 urn:id.gov.au:tdif:acr:ip1p:cl3
IP2                       AL2                                                      7
                                                 urn:id.gov.au:tdif:acr:ip2:cl2
                          AL3                                                      8
                                                 urn:id.gov.au:tdif:acr:ip2:cl3
IP2 Plus                  AL2                                                      9
                                                 urn:id.gov.au:tdif:acr:ip2p:cl2
                          AL3                                                      10
                                                 urn:id.gov.au:tdif:acr:ip2p:cl3
IP3                       AL2                                                      11
                                                 urn:id.gov.au:tdif:acr:ip3:cl2
                          AL3                                                      12
                                                 urn:id.gov.au:tdif:acr:ip2p:cl2
IP4                       AL3                                                      13
                                                 urn:id.gov.au:tdif:acr:ip4:cl3

 Table 2 Mapping of new authentication levels to legacy credential levels.

Authentication level  Credential level
AL1                   CL1
AL2                   CL2
AL3                   CL3

2.1.4      Identity resolution

 An IXP MUST generate pairwise identifiers as required in section 1.2.2 of this Schedule.

 If an IXP does not use sector identifiers, the IXP MUST generate a pairwise identifier for every distinct service it connects, even if these services are operated by the same PRP.

 If an IXP makes use of sector identifiers:

(a)            the pairwise identifiers MUST only have a one-to-one mapping with a sector identifier; and
(b)            a sector identifier MUST only map to a single PRP, regardless of the number of connected services.

 Pairwise identifiers MUST be used when presenting individuals to PRPs irrespective of the federation protocols being brokered by the IXP in a transaction.

2.1.5      Authenticated sessions

 An authenticated session managed by the IXP MUST expire.

 For each supported federation protocol, an IXP MUST provide PRPs with information regarding session expiration times.

 An IXP MAY support features as specified in the relevant federation protocol to allow refreshing of an authenticated session before expiry.

2.1.6      Single sign on

 An IXP MAY support a SSO scheme.

 If an IXP supports SSO, it MUST support the ability for a PRP to request authentication for a particular individual, using all the methods outlined in the profile of their supported federation protocols.

 An IXP MUST permit a PRP to request an individual's reauthentication even when a pre-existing session is active and valid, regardless of the PRP that created the session.

 An IXP MUST ensure their implementation of SSO does not result in the disclosure of attributes including restricted attributes of an individual.

2.1.7      Single logout

 If an IXP supports SSO, the IXP MUST implement SLO.

 The IXP MUST ensure their implementation of SLO does not result in the disclosure of attributes including restricted attributes of an individual.

2.1.8      Attribute service provider integration

 When an IXP receives an authentication request from a PRP that includes attributes supplied by an ASP, the IXP MUST facilitate gathering those attributes from the ASP.

 An IXP MUST implement mechanisms to support the access channels it has agreed with an ASP as referenced in section 4.1.2 of this Schedule.

 When accessing attributes directly from the ASP,