Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p21
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 74609–77900

by the client if the content does not contain a public key in the format prescribed in RFC 7517.

 As the authorisation server, a IXP MUST verify the content available from a client's registered
 jwks_uri contains a valid JSON Web Key Set. The example below is of a 2048-bit RSA key.

{
 "keys": [{
  "alg": "RS256",
  "e": "AQAB",
  "n": "kAMYD62n_f2rUcR4awJX4uccDt0zcXRssq_mDch5aifcShx9aTtTVza23PTn3KaKrsBXwWcfioXR6zQn5eYdZQVGNBfOR4rxF5i7t3hfb4WkS50EK1gBYk2lO9NSrQzxG9QsUsAnN6RHksXqsdOqvnxjLexDfIJlgbcCN9h6TBC66ZXv7PVhl19gIYVifSU7liHkLe0l0fw7jUI6rHLHf4d96_neR1HrNIK_xssr99Xpv1EM_ubxpktX0T925qej9fMEpzzQ5HLmcNt1H2_VQ_Ww1JOLn9vRnH48FDj7TxlIT74XdTZgTv31w_GRPAOfyxEw_ZUmxhz5ZngTlQ",
  "kty": "RSA",
  "kid": "oauth-client"
 }]
}

 Figure 1 JSON WEB Key Set example

 An IXP MAY allow native client applications to omit their key during registration if they are a Public Client using PKCE.

1.6   Grant types

 The grant type of authorisation_code MUST be supported by an IXP.

 The Authorisation Code authentication flow implemented by an IXP MUST follow the steps outlined in the section 3.1 (Authentication using the Authorization Code Flow) of OpenID Connect Core 1.0.

 If an IXP supports a Direct Access Client type, it MUST also support the grant type of
 client_credentials.

 Implementation of the Client Credentials grant MUST conform to RFC 6749.

1.7   Technical Relying Party Profile

 In this section the terms client and technical relying party (TRP) refer to the OpenID Connect Core 1.0 software operated by a PRP or an ASP.

1.7.1      Requests to the Authorisation Endpoint

 IXP's clients making a request to the Authorisation Endpoint SHOULD use an unpredictable value for the state parameter with at least 128 bits of entropy.

 IXP's clients MUST validate the value of the state parameter upon return to the redirect URI and MUST ensure that the state value is securely tied to the individual's current session, for example, by relating the state value to a session identifier issued by the client software to the browser.

 IXP's clients MUST include their full redirect URI in the authorisation request.

 To prevent open redirection and other injection attacks, an IXP MUST match the entire redirect URI using a direct string comparison against registered values and MUST reject requests with invalid or missing redirect URIs.

 The Authentication Request MUST contain the following REQUIRED parameters and MAY contain the following OPTIONAL parameter values:

       * client_id
                + REQUIRED. Client Identifier (within the meaning of RFC 6749) valid at the authorisation server.
       * response_type
                + REQUIRED. Must be set to code.
       * scope
                + REQUIRED. Indicates the attributes being requested. The openid scope MUST always be present. Additional scopes are defined in Schedule 3 (AGDIS Attribute Profile).
       * redirect_uri
                + REQUIRED. Indicates a valid endpoint where the client will receive the authentication response. The URI MUST match exactly one of the Redirection URIs preregistered at the IXP. The URI MUST follow the schemes outlined in section 1.4 of this Schedule.
       * state

            * REQUIRED. Un-guessable random string generated by the client used to protect