Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p23
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 80583–83833

* acr_values
                + OPTIONAL. A TRP may specify the required level(s) of assurance here. For permissible ACR values see section 1.9.3 of this Schedule.
       * code_challenge and code_challenge_method
                + OPTIONAL. If an IXP supports PKCE as described in section 1.2.2 of this Schedule, they MUST support these parameters.
       * max_age
                + OPTIONAL. Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the IXP. If the elapsed time is greater than this value, the IXP MUST attempt to actively re- authenticate the End-User.

       * ui_locales
                + OPTIONAL. End-User's preferred languages and scripts for the user interface, represented as a space-separated list of language tag values as specified in RFC 5646, ordered by preference.
       * id_token_hint
                + OPTIONAL. ID Token previously issued by the authorisation server being passed as a hint about the End-User's current or past authenticated session with the client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the authorisation server returns a positive response; otherwise, it MAY return an error, such as login_required.
       * login_hint
                + OPTIONAL. Hint to the authorisation server about the login identifier the End-User might use to log in (if necessary). This hint can be used by a TRP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorisation service.
       * user_flow
                + OPTIONAL. A string value that indicates the desired user flow for the individual. Defined values are:
                         o sign_in: A TRP requests this flow when it expects the user to already have a digital identity and sign in at the ISP.
                        o sign_up: A TRP requests this flow when it expects the user to need to create a digital identity at an ISP.
                         o mygov_link: A TRP requests this when it expects a user to set up a linkage between their myGov account and their digital ID.
       * claims
                + OPTIONAL. This parameter is used to request that specific Claims be returned. The value is a JSON object listing the requested Claims. This is made according to section 5.5 (Requesting Claims using the "claims" Request Parameter) of OpenID Connect Core 1.0

 A sample HTTP GET request may look like the following example:
https://idexchange.gov.au/oidc/authorization?response_type=code &client_id=827937609728-m2mvqffo9bsefh4di90saus4n0diar2h &scope=profile%20openid%20email &redirect_uri=https%3A%2F%2Frp.agency.gov.au%2Foidc%2FloginResponse &state=2ca3359dfbfd0 &prompt=select_account &acr_values=urn%3Aid.gov.au%3Atdif%3Aacr%3Aip3%3Acl2

 Figure 2 Example authorisation request

1.7.2      Requests to the Token Endpoint

 Requests to the Token Endpoint uses client authentication. The client authentication mechanism is signed JWT as defined in section 1.8.1.2 of this Schedule.

 The JWT assertion used in the client authentication MUST be signed by the client using the client's public key it has