Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p18
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 66867–69754

This client type applies to clients that act on behalf of a particular resource owner and require delegation of that user's authority to access the protected resource. This client type can interact with a separate web browser application to facilitate the resource owner's interaction with the authentication endpoint of the authorisation server.

 All IXP clients of this type MUST use the authorisation code flow of RFC 6749 by sending the resource owner to the Authorisation Endpoint to obtain authorisation.

 An IXP MUST ensure that the individual authenticates to the Authorisation Endpoint. The user's web browser is then redirected back to a URI hosted by the client service, from which the client can obtain an authorisation code passed as a query parameter. The client then presents that authorisation code along with its own credentials (private_key_jwt) to the authorisation server's Token Endpoint to obtain an access token.

 An IXP MUST associate the clients with a unique public key as described in section 1.5.1 of this Schedule.

 An IXP MAY issue this client type a refresh token if the security parameters of the access request allow for it.

1.2.2      Native Client with User Delegation

 A Native Client with User Delegations is a client that acts on behalf of a particular resource owner, such as an application on a mobile platform, and requires delegation of that individual's authority to the protected resource. This client type can interact with a separate web browser application to facilitate the resource owner's interaction with the authentication endpoint of the authorisation server. Specifically, this client type runs natively on the resource owner's device, often leading to many identical instances of a piece of software operating in different environments and running simultaneously for different end users.

 An IXP MAY support Native Clients with User Delegation.

 If an IXP supports Native Clients with User Delegation, the IXP MUST implement the following requirements.

 An IXP client MUST use the authorisation code flow of RFC 6749 by sending the resource owner to the Authorisation Endpoint to obtain authorisation.

 An IXP MUST authenticate an individual to the Authorisation Endpoint.

 The user's web browser is then redirected back to a URI hosted by the client, from which the client can obtain an authorisation code passed as a query parameter. The client then presents that authorisation code along to the authorisation servers Token Endpoint to obtain an access token.

 Native clients connecting to a IXP MUST either be:

 1.             dynamically registered to obtain a separate client identifier for each instance; or
 2.             act as Public Clients (as defined in section 2.1 (Client Types) of RFC 6749) by using a common client identifier and using PKCE (as per RFC 7636) to protect calls to the Token Endpoint.