Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p16
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 54667–60324

PRPs to access the attributes they control.

 For each access channel that an ASP makes available, the ASP MUST:

 1.             provide documentation outlining the technical integration requirements for the IXP and/or the PRP, as the case may be;
 2.             outline the attribute lifecycle features supported by the channel and how the IXP and/or PRP, as the case may be, can use them;
 3.             document and demonstrate how an individual's consent is collected and managed;
 4.             document and demonstrate how an individual can manage their consent; and
 5.             document how the audit logging will be undertaken.

4.2   Audit logging

 An ASP's audit log MUST include any individual's consent managed by the ASP that enables the sharing of attributes with PRPs.

 An ASP's audit log MUST include the value of the RP Audit ID supplied by the IXP:

 1.             when binding a digital ID brokered by the IXP to any of the attributes managed by the ASP;
 2.             if the IXP directly retrieves the attributes; and
 3.             if the ASP provides attributes indirectly and the RP Audit ID is available.

4.3   Attribute schema

 An ASP MUST publish an attribute schema for any attributes it provides.

 The attribute schema MAY support multiple data formats if required by the various access channels provided by the ASP to IXPs and PRPs to access the ASP's attributes.

 A published attribute schema MUST outline data types and constraints for the fields that comprise the attribute sets managed by the ASP.

 The published attribute schema MUST support a data format compatible with the federation protocol the ASP uses to connect to the IXP.

 An ASP MUST establish procedures to publish updates to their attribute schema in accordance with Schedule 3 (AGDIS Attribute Profile).

       Schedule 2 – AGDIS Open ID Connect Profile

 Contents

     1.          Identity exchange..................................................1

           1.      Authorisation grant types...................................................1

           2.      Client types..............................................................1

                 1.     Full Client with User Delegation.............................................1
                 2.     Native Client with User Delegation..........................................1
                 3.     Direct Access Client......................................................2

           3.      Client Registration.........................................................3

           4.      Redirect URI.............................................................3

                 1.     Native Client Applications.................................................3

           5.      Connection to the authorisation server.........................................4

                 1.     Client keys.............................................................4

           6.      Grant types..............................................................5

           7.      Technical Relying Party Profile...............................................5

                 1.     Requests to the Authorisation Endpoint......................................5
                 2.     Requests to the Token Endpoint............................................7
                 3.     Token response.........................................................9
                        1.        ID Tokens............................................................9

                 1.   . Request to the UserInfo Endpoint..........................................9
                 2.   . Request Object........................................................9
                 3.   . Discovery.............................................................9

           8.      Identity Exchange OpenID Connect provider Profile.............................10

                 1.     Connecting to clients....................................................10
                        1.        Grant types..........................................................10

                        2.        Client authentication...................................................10

                        3.        Dynamic registration...................................................11

                        4.        Discovery...........................................................11

                        5.        PKCE 14

                 1.   . Response to Authorisation Requests......................................14
                        1.        Authentication Error Response...........................................14

                        2.        Responding to Invalid Claims............................................15

                 2.   . Token Response......................................................15
                        1.        ID Token............................................................15

                 3.   . UserInfo Endpoint.....................................................16

        1.   . Request Objects.......................................................16
        2.   . Authentication Context..................................................16

      1.      Entity information........................................................16

            1.     Claims supported.......................................................16
            2.     Scope profiles..........................................................17
            3.     Valid ACR