Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p27
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 93051–97078

endpoint response.

{
    "issuer": "https://auth.identity.gov.au",
    "authorization_endpoint": "https://auth.identity.gov.au/authorise",
    "token_endpoint":
        "https://auth.identity.gov.au/sso/sps/oauth/oauth20/token",
    "userinfo_endpoint":
   "https://auth.identity.gov.au/sso/sps/oauth/oauth20/userinfo",
    "jwks_uri":
  "https://auth.identity.gov.au/.well-known/jwks.json",
    "end_session_endpoint": "https://auth.identity.gov.au/logout",
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code"
    ],
    "subject_types_supported": [
        "pairwise"

],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "phone",
        "tdif_business_authorisations",
        "tdif_doc",
        "tdif_other_names"
    ],
    "claims_supported": [
        "tdif_business_authorisations",
        "tdif_doc",
        "acr"
    ],
    "user_flows_supported": [
        "sign_in",
        "sign_up",
        "mygov_link"
    ],
    "prompts_supported": [
        "none",
        "login"
    ],
    "acr_values_supported": [
        "urn:id.gov.au:tdif:acr:ip1:cl1",
        "urn:id.gov.au:tdif:acr:ip1:cl2",

"urn:id.gov.au:tdif:acr:ip2:cl2",
        "urn:id.gov.au:tdif:acr:ip3:cl2"
    ],
    "frontchannel_logout_supported": true,
    "frontchannel_logout_session_supported": false
}

 Figure 5 Normative example of the well-known configuration

          1.8.1.5                  PKCE

 An authorisation server MUST support the PKCE extension to the authorisation code flow, including support for the S256 code exchange methods (within the meaning of RFC 7636).

 The authorisation server MUST NOT allow a client to use the plain code challenge method (within the meaning of RFC 7636).

1.8.2      Response to Authorisation Requests

 The authorisation code flow's authorisation response MUST return the following fields in the response:

       * state
                + The value of the state parameter passed in via the authentication request. This value MUST match exactly.
       * code
                + The authorisation code, a random string issued by the OIDC provider to be used request to the Token Endpoint.

 PKCE parameters MUST be associated with the "code" (refer above) within the meaning of RFC 7636.

 This response MUST be sent to the client via a HTTP redirect to the URI specified in the request.

          1.8.2.1                  Authentication Error Response

 The Authentication Error Response is the message returned from an IXP's Authorisation Endpoint in response to the Authorisation Request sent by the client.

 If the End-User denies or cancels the request or the End-User authentication fails, the OIDC provider informs the TRP by using the error responses defined in either section 4.1.2.1 (Error Response) of RFC 6749 or the error codes defined in section 3.1.2.6 (Authentication Error Response) of the OpenID Connect Core 1.0. The additional authentication error responses defined in this Schedule are:

         authentication_cancelled
          o        The End-User did not proceed with the authentication interaction.

          1.8.2.2                  Responding to Invalid Claims

 A scope or claim is invalid if a IXP cannot source the underlying attributes from its ISPs or ASPs and from the IXP specific attributes outlined in Chapter 4 of Schedule 3 (AGDIS Attribute Profile).

 If an IXP receives a request for a scope or claim it cannot fulfill, the IXP MUST ignore these scopes or claims.

 An IXP MUST deny an authentication request with the access_denied error code (as described in RFC 6749) if its client requests a scope or claim that under the relevant attribute sharing policy it is not authorised to request. For example, if a client requests a restricted attribute set when they are not approved to an access_denied error code MUST be returned.

1.8.3      Token Response