Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p35
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 116452–119577

than 300 seconds.

 An ISP's authorisation server MUST reject a JWT with an expiry time that has passed. An ISP SHOULD:
      1.             allow for clock skew of 300 seconds between systems when assessing the expiry of a JWT; and
      2.             reject any JWT with expiry that is unreasonably far into the future.

 The JWT MUST contain the following REQUIRED claims and MAY contain the following OPTIONAL claims:

  *          iss

  *          sub

  *          aud

    * REQUIRED. Issuer. This MUST contain the client_id of the client creating the token.

    * REQUIRED. Subject. This MUST contain the client_id of the client creating the token.

    * REQUIRED. Audience. The value that identifies the authorisation server as an intended audience. The authorisation server MUST verify that it is an intended audience for the token. The Audience MAY be the URL of the authorisation server's Token Endpoint.

       * jti

       * exp

       * iat

    * REQUIRED. JWT ID. A unique identifier for the token generated by the client, which can be used to prevent reuse of the token. This identifier MUST contain at least
  128 bits of entropy and MUST NOT be re-used by any subsequent authentication token.

    * REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted for processing.

    * OPTIONAL. Time at which the JWT was issued.

          2.7.2.3                  Dynamic registration

 An ISP MUST NOT support dynamic registration of IXPs as clients.

          2.7.2.4                  Discovery

 Endpoints and parameters specified in the Discovery document MAY be considered public information regardless of the existence of the discovery document.

 An ISP MAY provide a well-known endpoint for its OpenID configuration as described in the OpenID Connect Discovery 1.0.

 If an ISP provides a well-known endpoint, it MUST secure the well-known endpoint as outlined in the OpenID Connect Discovery 1.0 specification. An IXP MAY apply additional security controls if required by their business need.

 If an ISP publishes a discovery document, the document MUST as a minimum contain the following REQUIRED fields and MAY contain the OPTIONAL fields:

         issuer
          o        REQUIRED. The fully qualified issuer URL of the server.
         authorization_endpoint
          o        REQUIRED. The fully qualified URL of the server's Authorisation Endpoint defined in RFC 6749.
         token_endpoint
          o        REQUIRED. The fully qualified URL of the server's Token Endpoint defined in RFC 6749.
         introspection_endpoint
          o        OPTIONAL. The fully qualified URL of the server's introspection endpoint defined in RFC 7662.
         revocation_endpoint
          o        OPTIONAL. The fully qualified URL of the server's revocation endpoint as within the meaning of RFC 7009.
         jwks_uri
          o        REQUIRED. The fully qualified URI of the server's public key in JWK Set format as defined in RFC 7517.
         scopes_supported
          o        REQUIRED. The list of scopes that MUST be made available