Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p33
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 109966–113990

Core 1.0 parameters MAY also be mapped from the original request to the IXP that triggered the request from the IXP to the ISP. Mapping of these parameters are described Chapter4 of this Schedule.

2.6.3      Request to the Token Endpoint

 Request to the Token Endpoint require client authentication. The client authentication mechanism is a signed JWT and defined in the Identity Provider profile outlined in section 2.7 of this Schedule.

 The claims that are included in the JWT are summarised below:

       * iss

       * sub

       * aud

       * iat

       * exp

       * jti

    * The client Id of the client creating the JWT.

    * The client Id of the client creating the JWT.

    * The URL of the authorisation server's Token Endpoint.

    * The time that the token was created by the client.

    * The expiration time after which the token MUST be considered invalid.

    * A unique, random, identifier generated by the client for this authentication.

 An IXP making the request MAY include additional claims in this set.

 The following is an example of the required claims for a client authentication JWT as defined in this profile.
{
   "iss": "8428fea9-2815-82e9-a9f3-a32a9e9b723c",
   "sub": "8428fea9-2815-82e9-a9f3-a32a9e9b723c ",
   "aud": "https://idp.gov.au/token",
   "iat": 1516986988,
   "exp": 1516986929,
   "jti": "1516986988/c4da1075193e524df46b5e565c5a59568f34"
}

 Figure 7 Token Endpoint private JWT example

 The JWT assertion MUST be signed with the IXP's private key from the key pair they have registered with the ISP.

 The following claims MUST be included in a request to a Token Endpoint:

       * grant_type
                + MUST be set to authorization_code.
       * code
                + The value of the code parameter returned in the authorisation response.
       * redirect_uri
                + value MUST be identical to the value of the redirect_uri parameters that was included in the authorisation request.
       * client_assertion_type
                + MUST be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
       * client_assertion
                + The value of the signed client authentication JWT generated as described below in the ID Tokens section (section 2.6.5 of this Schedule). The TRP MUST generate a new assertion JWT for each call to the Token Endpoint.

 The following is an example of how these claims would be sent Token Endpoint:

POST /token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: idp.gov.au
grant_type=authorization_code
&code=sedaFh
&redirect_uri=https%3A%2F%2Fidexchange.gov.au%2Foidc%2FloginResponse
&client_id=55f9f559-2496-49d4-b6c3-351a586b7484
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.ew0KICAgImlzcyI6ICI1NWY5ZjU1OS0yNDk2LTQ5ZDQtYjZjMy0zNTFhNTg2Yjc0ODQiLA0KICAgInN1YiI6ICI1NWY5ZjU1OS0yNDk2LTQ5ZDQtYjZjMy0zNTFhNTg2Yjc0ODQiLA0KICAgImF1ZCI6ICJodHRwczovL2lkcC1wLmV4YW1wbGUuY29tL3Rva2VuIiwNCiAgICJpYXQiOiAxNDE4Njk4Nzg4LA0KICAgImV4cCI6IDE0MTg2OTg4NDgsDQogICAianRpIjogIjE0MTg2OTg3ODgvMTA3YzRkYTUxOTRkZjQ2M2U1MmI1Njg2NWM1YWYzNGU1NTk1Ig0KfQ.t_gX8JQGq3G2OEc2kUCQ8zVj7pqff87Sua5nktLIHj28l5onO5VpsL4sRHIGOvrpo7XO6jgtPWy3iLXv3-NLyo1TWHbtErQEGpmf7nKiNxVCXlGYJXSDJB6shP3OfvdUc24urPJNUGBEDptIgT7Lhf6BbwQNlMQubNeOPRFDqQoLWqe7UxuI06dKX3SEQRMqcxYSIAfP7CQZ4WLuKXb6oEbaqz6gL4l6p83G7wKGDeLETOTHsztZjKR38v4F_MnSrx8e0iIqgZwurW0RtetEWvynOCJXk-p166T7qZR45xuCxgOotXY6O3et4n77GtgspMgOEKj3b_WpCiuNEwQ
 Figure 8 UserInfo endpoint example request

2.6.4      Request to the UserInfo Endpoint

 An ISP MUST implement support for an IXP to send a UserInfo request using either the HTTP GET or POST methods.

 The Access Token obtained from authentication request MUST be sent as a Bearer Token, as described in RFC 6750.

2.6.5      ID Tokens

 An IXP MUST validate the signature of an ID Token before accepting it by using the public key of the ISP that issued it.

 An IXP MAY require an ISP to encrypt the