Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p31
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 104668–107436

MUST register with the authorisation server.

 Each client IXP MUST receive a unique client identifier from the authorisation server. Clients of the authorisation server MUST be statically configured.
 An ISP MUST NOT support the dynamic registration of IXPs.

2.3   Redirect URI

 An ISP MUST register an IXP's full redirect URIs as required by the authorization_code grant type.

 The authorisation server MUST validate the redirect URI passed to the authorisation end using strict string comparison.

 An ISP MUST only permit TLS protected redirect URIs to be registered.

 An ISP MUST NOT permit a IXP to have multiple redirect URIs on different domains.

 An ISP MUST NOT forward values passed back to their redirect URIs to other arbitrary or user provided URIs.

 An ISP MUST NOT permit open redirection.

2.4   Client keys

 All connected IXPs acting as clients MUST have a public and private key that MUST be used when authenticating to the Token Endpoint.

 As clients all IXPs MUST:

 1.             provide their public keys in their client registration metadata; or
  2.             provide an avenue for entities to obtain or reference their public keys. An ISP SHOULD support the use of jwks field, or registration of a jwks_uri.
 If a IXP uses a jwks_uri to register its public key, the URI MUST be reachable by the authorisation server.

 If an ISP supports the use of jwks_uri:

 1.             the IXP SHOULD use a jwks_uri to simplify key rotation; and
 2.             the ISP MUST validate the content of the clients registered jwks_uri document.

2.5   Grant types

 An ISP MUST only support the authorization_code grant type when providing services to IXPs.

2.6   Technical Relying Party Profile

 This section outlines the profile that an ISP MUST provide for the IXPs that are its TRPs.

2.6.1      Audit Logging

 An IXP MUST log all interactions with its ISPs using a unique audit identifier it has generated for an authentication request from its TRP.

 To enable a traceable audit trail for requests sent to an ISP, an IXP MUST implement a scheme to ensure that each request is uniquely identifiable at the ISP.

 A recommended scheme is for an IXPs to transport a unique generated value using the state
 parameter. Note this unique value MUST NOT be the RP audit ID issued by an IXP to an PRP.

2.6.2      Request to the Authorisation Endpoint

 An IXP making a request to the Authorisation Endpoint MUST use an unpredictable value for the
 state parameter with at least 128 bits of entropy.

 An IXP MUST validate the state parameter upon return to the redirect URI.

 An IXP MUST ensure that the state value is securely tied to the user's current IXP session. An IXP MUST include their redirect URIs in the authorisation