Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p11
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 39351–42747

per the role specific role requirements outlined in the following specified sections of OpenID Connect Core 1.0.

 If a sector identifier is used, it MUST conform to the definition outlined in the following specified sections of OpenID Connect Core 1.0.

 For this standard, the following sections of OpenID Connect Core 1.0 are specified:

(a)            section 1.2 (Terminology); and
(b)            section 8.1 (Pairwise Identifier Algorithm).

1.3   Data sharing

 Irrespective of the federation protocol used, ASPs, ISPs and IXPs MUST handle and transmit data in accordance with the data sharing policies outlined in Schedule 3 (AGDIS Attribute Profile).

1.3.1      Request processing

 ASPs, ISPs and IXPs MUST NOT attempt to fulfill requests for unknown attributes or attribute sets.

 Requests for known attributes or attribute sets that cannot be fulfilled, regardless of the reason, MUST NOT be returned with empty values unless explicitly permitted by an attribute sharing policy as outlined in Schedule 3 (AGDIS Attribute Profile).

2.        Identity exchange provider

 This Chapter outlines the requirements that MUST be met by IXPs.

2.1   Technical integration requirements

2.1.1      Protocol requirements

 An IXP MUST implement Schedule 2 (AGDIS OpenID Connect Profile) for an:

(a)            IXP acting as an OIDC provider; and
(b)            IXP acting as TRP to an ISP.

2.1.2      Audit requirements

 An IXP MUST generate the RP Audit ID attribute as outlined in Schedule 3 (AGDIS Attribute Profile).

 The IXP MUST provide the RP Audit ID attribute it generated in response to every logical transaction between itself (the IXP) and the PRP (including ASPs).

 The IXP MUST include the RP Audit ID attribute it generated for the PRP's authentication request in every logical transaction between itself and each of the ASPs required to fulfill the attribute requirements of a PRP's authentication request.

 The IXP MUST NOT send the RP Audit ID attribute it generated for the PRP's authentication request to its ISP.

2.1.3      Levels of assurance

 Levels of assurance are used to define the IP level and AL of an individual's authenticated session.

 Levels of assurance are ranked from the lowest to the highest degree of confidence in the authentication process. The rankings of levels of assurance are specified in Table 1below.

 Note the URNs in Table 1below MUST reference the legacy acronym cl (credential level) in their namespace to represent AL.

 A mapping of the new ALs to the legacy credential levels, used in the URNs outlined in Table 1, is provided below in Table 2.

 An IXP MUST allow a PRP to request a minimum level of assurance when making authentication requests.

 Table 1 Level of assurance combinations used in the AGDIS.

Identity proofing level   Authentication level   URN                               Ranking (low to high)
IP1                       AL1                                                      1
                                                 urn:id.gov.au:tdif:acr:ip1:cl1
                          AL2                                                      2
                                                 urn:id.gov.au:tdif:acr:ip1:cl2
                          AL3                                                      3
                                                 urn:id.gov.au:tdif:acr:ip1:cl3
IP1