Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p10
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 33359–39606

– AGDIS Onboarding Specifications

 Contents

     1.          Common requirements for participating accredited entities..................1

           1.      Security considerations.....................................................1

           2.      Identity resolution.........................................................1

                 1.       General purposes identifiers...............................................1

                 2.       Pairwise identifiers.......................................................1

                 3.       Sector Identifiers........................................................1

           3.      Data sharing.............................................................2

                 1.       Request processing......................................................2

    2.      Identity exchange provider...........................................3

           1.      Technical integration requirements...........................................3

                 1.       Protocol requirements....................................................3

                 2.       Audit requirements.......................................................3

                 3.       Levels of assurance......................................................3

                 4.       Identity resolution........................................................5

                 5.       Authenticated sessions...................................................5

                 6.       Single sign on...........................................................5

                 7.       Single logout............................................................5

                 8.       Attribute service provider integration.........................................5

                 9.       Federation protocol brokering..............................................6

           2.      Identity provider selection...................................................6

                 1.       Blinding................................................................6

           3.      User dashboard...........................................................7

           4.      Data requirements........................................................7

                 1.       Attribute requirements....................................................7

                 2.       Computed attributes......................................................7

                 3.       Attribute sharing policy....................................................7

                 4.       Data representation......................................................8

    3.      Identity service provider.............................................8

           1.      Technical integration requirements...........................................8

                 1.       Protocol requirements....................................................8

                 2.       Identity resolution........................................................8

                 3.       Single sign on...........................................................8

                 4.       Single logout............................................................8

      1.      Data requirements........................................................9

            1.       Attribute requirements....................................................9

            2.       Computed attributes......................................................9

    1.      Attribute service provider............................................9

           1.      Technical integration requirements...........................................9

                 1.       Protocol requirements....................................................9

                 2.       Access channels........................................................9

           2.      Audit logging............................................................10

           3.      Attribute schema.........................................................10

 List of Tables

 Table 1 Level of assurance combinations used in the AGDIS.........................4

 Table 2 Mapping of new authentication levels to legacy credential levels................4

    1.        Common requirements for participating accredited entities

 This Chapter outlines the role requirements, where applicable, that MUST be met by ASPs, ISPs and IXPs.

1.1   Security considerations

 ASPs, ISPs and IXPs:

 1.             MUST comply with the security considerations in section 10 (Security Considerations) of RFC 6749; and
 2.             SHOULD consider the additional security considerations in section 5 (Security Considerations) of RFC 6819.

1.2   Identity resolution

1.2.1      General purposes identifiers

 An IXP MUST NOT issue a GPI.

 An ISP MAY issue a GPI. Where an ISP chooses to issue a GPI, the ISP MUST:

(a)            bind the GPI to only a single digital ID account;
(b)            only use the GPI within the AGDIS;
     (c)            only use the GPI to map the individual's digital ID to a single IXP; and
     (d)            issue additional GPIs for each IXP an individual accesses.

 A GPI MUST be unique within the DI data environment of the ISP that issues it.

1.2.2      Pairwise identifiers

 An IXP MUST issue a pairwise identifier.

 An ISP SHOULD issue a pairwise identifier. If an ISP issues a pairwise identifier, the ISP MUST NOT issue a GPI.

 IXPs or ISPs that issue digital ID identifiers as pairwise identifiers MUST generate the identifiers in accordance with the algorithm outlined in section 8.1 (Pairwise Identifier Algorithm) of OpenID Connect Core 1.0.

1.2.3      Sector Identifiers

 IXPs and ISPs SHOULD use sector identifiers.

 The scope of a sector identifier MUST be limited as per the role specific role requirements outlined in the following specified sections of OpenID Connect Core 1.0.

 If a sector identifier is used, it MUST conform to the definition outlined in the following specified sections of OpenID Connect Core 1.0.