Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p19
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 69520–72326

identifier for each instance; or
 2.             act as Public Clients (as defined in section 2.1 (Client Types) of RFC 6749) by using a common client identifier and using PKCE (as per RFC 7636) to protect calls to the Token Endpoint.

 An IXP supporting dynamic registration of native applications MUST support one of the following methods to register or exchange a unique public key value:

 1.             the native application generates unique public and private keys on the device and registers the public key value with the IXP; or
 2.             the IXP generates a unique public and private key pair, registering the public key with itself and securely transmitting the public and private key pair to the client. After transmission, the IXP MUST discard the private key.

 An IXP MUST NOT permit sharing of client credentials among instances of client software.

 All native applications registered with a IXP not registering a separate public key for each instance are considered Public Clients and MUST use PKCE with the S256 code challenge method (within the meaning of RFC 7636).

 An IXP MUST NOT permit Public Clients to authenticate to the Token Endpoint in any other way.

 If an IXP supports Native Clients with User Delegation, the IXP MAY implement the following requirements.

 An IXP MAY permit dynamically registered native applications to use PKCE.

 An IXP MAY issue a refresh token to a Native Client with User Delegation if the IXP is satisfied that there are no security issues.

1.2.3      Direct Access Client

 A Direct Access Client is a client that connects directly to protected resources and do not act on behalf of a particular resource owner, for example, machine to machine access.

 An IXP MAY only implement this client type to support interactions between itself and other entities participating in the AGDIS.

 If an IXP supports the Direct Access Client type, the IXP MUST support the confidential client type and the client_credentials grant types.

1.3   Client Registration

 An IXP MUST support Client Registration by static configuration or dynamic configuration. An IXP MAY support both static and dynamic Client Registration.

 All clients of an IXP MUST register with the authorisation server.

 For client software that may be installed on multiple client instances, an IXP MUST issue each client instance a unique client identifier from the authorisation server.

 An IXP MUST advise a PRP of the information that is required to be supplied when configuring its connection as a TRP of the IXP.

 Where a TRP is seeking to register by dynamic configuration, an IXP MUST require the TRP provide an initial access token (as defined in RFC 7591).

 If an IXP supports dynamic registration of clients, the IXP MUST implement support for bearer tokens in