Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p28
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 96825–99665

claim that under the relevant attribute sharing policy it is not authorised to request. For example, if a client requests a restricted attribute set when they are not approved to an access_denied error code MUST be returned.

1.8.3      Token Response

 All tokens issued by an IXP MUST be signed with the IXP's private key.

 For clients using the Authorisation Code Grant type, access tokens MUST have a valid lifetime of no greater than one hour (which is 3,600 seconds).

 If an IXP issues refresh token they MUST have a lifespan of no longer than 24 hours (which is 86,400 seconds).

 Token lifespans MAY be shorter than these prescribed values to meet the requirements of an IXP's security risk assessment.

          1.8.3.1                  ID Token

 An IXP MAY encrypt an ID Token or the ID Token's fields with the requesting clients public key when the ID Token contains attributes of the individual.

 An IXP issued ID Token MUST:

 1.             expire; and
 2.             have a lifespan of no longer than 300 seconds.

 An IXP SHOULD assign lifespans of shorter than 300 seconds to an ID Token.

 An IXP issued ID Token MUST contain the following fields that are defined as REQUIRED. An IXP issued ID Token MAY include the following fields that are defined as OPTIONAL. ID token fields:
  *          iss

  *          aud

  *          sub

  *          acr

    * REQUIRED. The issuer field is the URL of the expected issuer.

    * REQUIRED. The audience field contains the client ID of the client.

    * REQUIRED. The identifier of the user. Note it MUST be a pairwise identifier and be unique to the client's sector.

    * REQUIRED. This is the level of assurance at which the user was authenticated at.

       * nonce
                + If a nonce value was supplied with the authentication request, then this value is REQUIRED.
       * jti
                + REQUIRED. A unique identifier for the token which can be used to prevent the reuse of the token.
       * exp, iat, nbf
                + REQUIRED. The expiration, issued at, and not before timestamps for the tokens. They are dates presented as an integer representing the number of seconds since 1970- 01-01T00:00:00Z UTC (Unix epoch) within acceptable ranges.

1.8.4      UserInfo Endpoint

 An IXP MUST support returning claims via the UserInfo endpoint as prescribed by the requirements outlined in section 4.1.1 of Schedule 3 (AGDIS Attribute Profile).

 When processing a UserInfo request, a IXP MUST only return the claims that are authorised within the authentication request associated with the presented access token.

 An IXP MUST NOT return empty or null values for claims that cannot be fulfilled unless Chapter 2 and Chapter 3 of Schedule 3 (AGDIS Attribute Profile) specifically permits these values for a given attribute set.

 The