Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p32
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 107208–110205

An IXP MUST validate the state parameter upon return to the redirect URI.

 An IXP MUST ensure that the state value is securely tied to the user's current IXP session. An IXP MUST include their redirect URIs in the authorisation request.
 An ISP MUST match the entire redirect URI using strict string comparison against registered values and reject request with missing or invalid redirect URIs.

 The authentication request MUST contain the following REQUIRED parameters and MAY contain the following OPTIONAL parameters.

       * client_id
                + REQUIRED. Client Identifier (within the meaning of RFC 6749) assigned to a IXP by the ISP.
       * response_type
                + REQUIRED. MUST be set to code.
       * scope
                + REQUIRED. Indicates the attributes being requested. The openid scope MUST always be present.
       * redirect_uri
                + REQUIRED. Indicates the valid endpoint where the client will receive the authorisation response. The URI MUST exactly match one of preregistered redirect URIs at the ISP.
       * state
                + REQUIRED. An opaque value generated by the IXP used to protect against CSRF attacks. The value MUST contain sufficient entropy to avoid guessing and is returned to the IXP in the authentication response.
                + An IXP SHOULD use a unique value for each authorisation request.
       * nonce
                + REQURIED. Un-guessable random string generated by the client, used to protect against cross site request forgery attacks. The string MUST contain sufficient entropy to avoid guessing. The value is returned to the IXP in the ID Token.
       * acr_values
                + OPTIONAL. If the originating PRP requesting authentication has supplied acr_values a IXP MUST pass these values in accordance with protocol brokering requirements outlined in section 2.8.3 of this Schedule.
       * user_flow
                + OPTIONAL. A string value that indicates the desired user flow for the user. Defined values are:
                         o sign_in: An Exchange requests this when a TRP expects the user to already have a digital ID and sign in at the ISP.

                * sign_up: A IXP requests this when a TRP expects the individual to need to create a digital ID at an ISP.
       * claims
                + OPTIONAL. This parameter is used to request that specific Claims be returned. The value is a JSON object listing the requested Claims. This is made according to section 5.5 (Requesting Claims using the "claims" Request Parameter) of OpenID Connect Core 1.0.

 The values of the claims, scope and acr_values parameters are mapped from the original authentication request to the IXP from one of its TRPs. Additional OpenID Connect Core 1.0 parameters MAY also be mapped from the original request to the IXP that triggered the request from the IXP to the ISP. Mapping of these parameters are described Chapter4 of this Schedule.

2.6.3      Request to the Token Endpoint