Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p36
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 119309–122429

the meaning of RFC 7009.
         jwks_uri
          o        REQUIRED. The fully qualified URI of the server's public key in JWK Set format as defined in RFC 7517.
         scopes_supported
          o        REQUIRED. The list of scopes that MUST be made available by an ISP as defined in Schedule 3 (AGDIS Attribute Profile).
         claims_supported

          o        REQUIRED. The list of claims that MUST be made available by an ISP as defined in Schedule 3 (AGDIS Attribute Profile).

      2.7.3      Requests to the Authorisation Endpoint (Authentication Request)

 An ISP MUST support all mechanisms for requesting a level of assurance as prescribed in section
 2.8.3 of this Schedule.

2.7.4      User consent

 As a central and trusted participant of the AGDIS, all IXPs are responsible for collecting express consent from the individual in accordance with the attribute sharing policies outlined in Chapter 2 and Chapter 3 of Schedule 3 (AGDIS Attribute Profile).

 An IXP MUST provide the mechanisms to capture express consent from the individual.

 An ISP MAY gather consent from the individual to share attributes to the AGDIS but SHOULD take into consideration the end-to-end user experience impacts of additional consent gathering mechanisms.

2.7.5      Response to Authorisation Requests

 The authorisation response to the authorisation code flow MUST return the following fields in the response:

       * state
                + The value of the state parameter passed in via the authentication request. This value MUST match exactly.
       * code
                + The authorisation code, a random string issued by the OIDC provider to be used request to the Token Endpoint.

 The key requirements for these fields are described in section 4.1.2 (Authorization Response) of RFC 6749.

 This response MUST be sent to the client via a HTTP redirect to the URI specified in the request.

          2.7.5.1                  Authentication Error Response

 The Authentication Error Response is the message returned from an ISP's Authorisation Endpoint in response to the Authorisation Request sent by an IXP.

 If the individual denies or cancels the request, or the individual fails to authenticate, the ISP MUST inform the IXP by using the error responses defined in either:

 1.             section 4.1.2.1 (Error Response) of RFC 6749; or
  2.             section 3.1.2.6 (Authentication Error Response) of OpenID Connect Core 1.0. This profile defines an additional authentication error response:
           +          authentication_cancelled
                   o         The End-User did not proceed with the authentication interaction.

2.7.6      Token Response

 A successful token response includes an access token, which can be used to make a UserInfo request, and as ID token (signed and optionally encrypted JWT) as per section 3.1.3.3 (Successful Token Response) of the OpenID Connect Core 1.0.

 An ISP MAY also include a Refresh Token in the Token Response.

          2.7.6.1                  ID Token
An ISP MAY encrypt ID Tokens using the appropriate key of the