Document ID: chunk:federal_register_of_legislation:F2024L01443:schedule:3:p3
Version: federal_register_of_legislation:F2024L01443
Segment Type: schedule
Provision Reference: sch 3 (pt 3/21)
Character Range: 245861–249703

along with data types, is presented in Table 46 below.

 Additional scopes for Self-Asserted Attributes that an IXP SHOULD support brokering attribute requests for are:
       * adgis_address
       * agdis_other_email
       * agdis_other_phone
       * agdis_birth_place
       * agdis_personal_title

 The Self-Asserted Attributes are mapped to OIDC scopes and claims are outlined in Table 43 below, with detailed mapping from attributes to claims provided in Table 46 below.

 An IXP SHOULD support brokering of attributes requests for each claim outlined in Table 42 below and Table 43 below.

 An IXP MAY fulfill attributes request via either the Token or UserInfo Endpoints.

 An IXP MUST encrypt all scopes and claims, except for the common attributes set, when fulfilling attribute requests via the Token Endpoint.

      4.1.2      Identity provider scopes and claims

 The scopes an ISP MUST make available for its IXPs to request are:

       * openid
       * tdif_core
       * tdif_email
       * tdif_phone
       * tdif_other_names
       * tdif_docs

 The attribute sets mapped to these OpenID Connect Core 1.0 scopes along with the relevant sets of claims are outlined in Table 44. A detailed attribute mapping to claims, along with data types, is presented in Table 46.

 Additional scopes for Self-Asserted Attributes an ISP SHOULD make available for its IXPs to request are:
       * adgis_address
       * agdis_other_email
       * agdis_other_phone
       * agdis_birth_place
       * agdis_personal_title

 The self-asserted attribute sets are mapped to OpenID Connect Core 1.0 scopes and claims are outlined in Table 45, with detailed mapping from attributes to claims in Table 46.

 An ISP SHOULD support attribute requests for each individual claim outlined in Table 44 and Table 45.

 An ISP MAY fulfill attributes request via either the Token or UserInfo Endpoints.

 An ISP SHOULD encrypt all scopes and claims, except for the common attributes set, when fulfilling and attribute requests via the Token Endpoint.

 Table 42 OIDC Attribute profile for IXP relying parties

Attribute Set  Scope    Claims                                    Endpoint         Notes
Common         openid   sub auth_time acr                         Token UserInfo   An IXP SHOULD ignore or respond with an error to attribute requests if this scope is missing.
                        amr tdif_audit_id
                                                                                   All common claims MUST be present in the response.
Core           profile  name family_name given_name middle_name   Token UserInfo   Preferred Name is a self-asserted attribute, see section 2.3.1 of this Schedule
                        preferred_username birthdate updated_at

Attribute Set            Scope                        Claims                                             Endpoint          Notes
Validated Email          email                        email email_verified                                Token UserInfo   An IXP MUST return all claims when fulfilling the scope.
                                                      tdif_email_updated_at
Validated Phone          phone                        phone phone_number_verified tdif_phone_updated_at   Token UserInfo   An IXP MUST return all claims when fulfilling the scope.
Verified Other Names     tdif_other_names             tdif_other_names tdif_other_names_updated           Token UserInfo   An IXP MUST return all claims when fulfilling the scope.
Verified Documents       tdif_doc                     tdif_doc                                           UserInfo          Access to these scopes and claims is restricted.
Business Authorisations  tdif_business_authoristions  tdif_business_authoristions                        UserInfo          Supplied by the Australian