Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p24
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 83579–87538

Endpoint uses client authentication. The client authentication mechanism is signed JWT as defined in section 1.8.1.2 of this Schedule.

 The JWT assertion used in the client authentication MUST be signed by the client using the client's public key it has registered with the Authorisation server. Registration of keys should occur in accordance with process outlined section 1.5.1 of this Schedule.

 For clients that are required to use PKCE as described in section 1.2.2 and section 1.4 of this Schedule, the following claims MUST be included in the request to the Token Endpoint.

       * code_verifier
                + Code verifier generated by client to use PKCE with the S256 code challenge method (within the meaning of RFC 7636).

 A TRP MUST include the following claims in the request to the Token Endpoint, when requesting authentication for an individual:

       * grant_type
                + MUST be set to authorization_code.
       * code
                + The value of the code parameter returned in the authorisation response.
       * redirect_uri
                + Value MUST be identical to the redirect_uri parameter that was included in the authorisation request as described above.
       * client_assertion_type
                + MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
       * client_assertion
                + The value of the signed client authentication JWT generated as described in section
          1.7.3.1 of this Schedule. The Client MUST generate a new assertion JWT for each call to the Token Endpoint.

 These would be sent to the Token Endpoint as illustrated in the HTTP POST example below.
POST /token HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: idexchange.gov.au grant_type=authorization_code &code=sedaFh &scope=openid+email+profile &redirect_uri=https%3A%2F%2Frp.agency.gov.au%2Foidc%2FloginResponse &client_id=55f9f559-2496-49d4-b6c3-351a586b7484 &client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclientassertion- type%3Ajwt-bearer &client_assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.ew0KICAgImlzcy I6ICI1NWY5ZjU1OS0yNDk2LTQ5ZDQtYjZjMy0zNTFhNTg2Yjc0ODQiLA0KICAgInN1YiI 6ICI1NWY5ZjU1OS0yNDk2LTQ5ZDQtYjZjMy0zNTFhNTg2Yjc0ODQiLA0KICAgImF1ZCI6
ICJodHRwczovL2lkcC1wLmV4YW1wbGUuY29tL3Rva2VuIiwNCiAgICJpYXQiOiAxNDE4N jk4Nzg4LA0KICAgImV4cCI6IDE0MTg2OTg4NDgsDQogICAianRpIjogIjE0MTg2OTg3OD gvMTA3YzRkYTUxOTRkZjQ2M2U1MmI1Njg2NWM1YWYzNGU1NTk1Ig0KfQ.t_gX8JQGq3G2
OEc2kUCQ8zVj7pqff87Sua5nktLIHj28l5onO5VpsL4sRHIGOvrpo7XO6jgtPWy3iLXv3 NLyo1TWHbtErQEGpmf7nKiNxVCXlGYJXSDJB6shP3OfvdUc24urPJNUGBEDptIgT7Lhf6 BbwQNlMQubNeOPRFDqQoLWqe7UxuI06dKX3SEQRMqcxYSIAfP7CQZ4WLuKXb6oEbaqz6g L4l6p83G7wKGDeLETOTHsztjKR38v4F_MnSrx8e0iIqgZwurW0RtetEWvynOCJXkp166T 7qZR45xuCxgOotXY6O3et4n77GtgspMgOEKj3b_WpCiuNEwQ

 Figure 3 Sample Token Endpoint HTTP POST request

1.7.3      Token response

 The token response includes an access token, which can be used to make a UserInfo request as per section 1.7.4 of this Schedule, and an ID token as per section 3.1.3.3 (Successful Token Response) of OpenID Connect Core 1.0. It MAY also include a Refresh token.

          1.7.3.1                  ID Tokens

 All clients MUST validate the signature of an ID Token before accepting it using the public key of the issuing server, published in JWK format.

 An IXP MAY encrypt ID Tokens using the appropriate key of the requesting client. An IXP's TRPs MUST verify the following in received ID tokens:
         iss

         aud

    * The Issuer field is the URL of the expected issuer.

    * The audience field contains the client ID of the client.
       * exp, iat, nbf
                + The expiration, issued at and not before tokens are dates (integer number of seconds since 00:00:00Z 1st January 1970, i.e. Unix epoch) are within acceptable ranges.

1.7.4      Request to the UserInfo Endpoint

 An IXP MUST be able to accept UserInfo Request from clients using either the HTTP