Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p26
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 90078–93945

authorisation server MUST verify that it is an intended audience for the token. The Audience MAY be the URL of the authorisation server's Token Endpoint.

    * REQUIRED. JWT ID. A unique identifier for the token generated by the client, which can be used to prevent reuse of the token. This identifier MUST contain at least

       * exp

       * iat

  128 bits of entropy and MUST NOT be re-used by any subsequent authentication token.

    * REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted for processing.

    * OPTIONAL. Time at which the JWT was issued.

 The following is an example of the use of the REQUIRED claims for a client authentication JWT as defined in this Schedule. Noting that additional claims MAY be included in this set.

{
"iss": "55f9f559-2496-49d4-b6c3-351a586b7484",
"sub": "55f9f559-2496-49d4-b6c3-351a586b7484",
"aud": "https://idexchange.gov.au/token",
"iat": 1418698788,
"exp": 1418698848,
"jti": "1418698788/107c4da5194df463e52b56865c5af34e5595"
}
 Figure 4 Client authentication JWT example

          1.8.1.3                  Dynamic registration

 An IXP MAY support the dynamic registration of clients.

          1.8.1.4                  Discovery

 Endpoints and parameters specified in the discovery document below MAY be considered public information regardless of the existence of the discovery document.

 An IXP MUST provide a well-known endpoint for its configuration as described in the OpenID Connect Discovery 1.0.

 An IXP MUST secure the well-known endpoint as outlined in OpenID Connect Discovery 1.0. An IXP MAY apply additional security controls if required by their business need.

 The discovery document published by a IXP MUST as a minimum contain the following fields:

         issuer
          o        REQUIRED. The fully qualified issuer URL of the server.
         authorization_endpoint
          o        REQUIRED. The fully qualified URL of the server's Authorisation Endpoint defined in RFC 6749.

         token_endpoint
          o        REQUIRED. The fully qualified URL of the server's Token Endpoint defined in RFC 6749.
         introspection_endpoint
          o        OPTIONAL. The fully qualified URL of the server's introspection endpoint defined in RFC 7662.
         revocation_endpoint
          o        OPTIONAL. The fully qualified URL of the server's revocation endpoint as within the meaning of RFC 7009.
         jwks_uri
          o        REQUIRED. The fully qualified URI of the server's public key in JWK Set format as defined in RFC 7517.
         scopes_supported
          o        REQUIRED. The list of scopes that MUST be made available by a IXP as defined in Schedule 3 (AGDIS Attribute Profile).
         claims_supported
          o        REQUIRED. The list of claims that MUST be made available by an IXP as defined in Schedule 3 (AGDIS Attribute Profile).

 The following is sample of the current AGDIS IXP's well-known endpoint response.

{
    "issuer": "https://auth.identity.gov.au",
    "authorization_endpoint": "https://auth.identity.gov.au/authorise",
    "token_endpoint":
        "https://auth.identity.gov.au/sso/sps/oauth/oauth20/token",
    "userinfo_endpoint":
   "https://auth.identity.gov.au/sso/sps/oauth/oauth20/userinfo",
    "jwks_uri":
  "https://auth.identity.gov.au/.well-known/jwks.json",
    "end_session_endpoint": "https://auth.identity.gov.au/logout",
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code"
    ],
    "subject_types_supported": [
        "pairwise"

],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "phone",
        "tdif_business_authorisations",
        "tdif_doc",
        "tdif_other_names"