Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p17
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 59340–67118

1.        Authentication Error Response...........................................14

                        2.        Responding to Invalid Claims............................................15

                 2.   . Token Response......................................................15
                        1.        ID Token............................................................15

                 3.   . UserInfo Endpoint.....................................................16

        1.   . Request Objects.......................................................16
        2.   . Authentication Context..................................................16

      1.      Entity information........................................................16

            1.     Claims supported.......................................................16
            2.     Scope profiles..........................................................17
            3.     Valid ACR Claims.......................................................17

      2.  User consent............................................................18

      3.  Privacy considerations....................................................18

      4.  Security considerations....................................................18

     1.          Identity service provider............................................19

           1.      Client types.............................................................19

                 1.     Full Client with User Delegation............................................19

           2.      Client registration........................................................19

           3.      Redirect URI............................................................20

           4.      Client keys..............................................................20

           5.      Grant types.............................................................20

           6.      Technical Relying Party Profile..............................................20

                 1.     Audit Logging..........................................................20
                 2.     Request to the Authorisation Endpoint......................................21
                 3.     Request to the Token Endpoint............................................22
                 4.     Request to the UserInfo Endpoint..........................................24
                 5.     ID Tokens.............................................................24
                 6.     Request Objects........................................................24
                 7.     Discovery.............................................................24

           7.      Identity Provider Profile....................................................24

                 1.     Audit Logging..........................................................25
                 2.     Connecting to clients....................................................25
                        1.        Grant types..........................................................25

                        2.        Client authentication...................................................25

                        3.        Dynamic registration...................................................26

                        4.        Discovery...........................................................26

                 1.   . Requests to the Authorisation Endpoint (Authentication Request)................27
                 2.   . User consent.........................................................27
                 3.   . Response to Authorisation Requests......................................27
                        1.        Authentication Error Response...........................................27

                 4.   . Token Response......................................................28

           1.        ID Token............................................................28

        1.   . UserInfo Endpoint.....................................................29
        2.   . Request Object.......................................................29
        3.   . Authentication context..................................................30

      1.      Entity information........................................................30

            1.     Claims supported.......................................................30
            2.     Scope profiles..........................................................30
            3.     Valid ACR Claims.......................................................30

      2.      Privacy Requirements.....................................................31

      3.  Security Considerations...................................................31

     1.          Protocol brokering................................................32

           1.      OIDC to OIDC brokering...................................................32

                 1.     Mapping Claims and Scopes..............................................32
                 2.     Handling of Subject ID...................................................32
                 3.     Mapping assurance levels................................................32
                 4.     Prompt Parameter......................................................33
                 5.     ID Token Hint Parameter.................................................33

     2.          Attributes.......................................................34

           1.      Restricted attributes......................................................34

           2.      OIDC Attribute Mapping...................................................34

 List of Tables

 Table 1 IXP prompt parameter brokering requirements.............................33

 List of Figures

 Figure 1 JSON WEB Key Set example...........................................4

 Figure 2 Example authorisation request..........................................7

 Figure 3 Sample Token Endpoint HTTP POST request..............................8

 Figure 4 Client authentication JWT example.....................................11

 Figure 5 Normative example of the well-known configuration........................14

 Figure 6 Requesting authentication assurance level with claims......................17

 Figure 7 Token Endpoint private JWT example...................................22

 Figure 8 UserInfo endpoint example request.....................................23

 Figure 9 Sample ID Token signature............................................29

 Figure 10 Claims used to the generate the prior signature...........................29

 Figure 11 Sample assurance level requests using claims...........................31

1.        Identity exchange

 This Chapter outlines the requirements that an IXP MUST satisfy to facilitate brokering access to ISPs using OpenID Connect Core 1.0 as their federation protocol.

 Interoperability between IXPs is not within scope for this release of the Digital ID (AGDIS) Data Standards 2024.

1.1   Authorisation grant types

 An IXP MUST NOT use the resource owner password credentials grant type defined in RFC 6749.

1.2   Client types

1.2.1      Full Client with User Delegation

 An IXP MUST support the Full Client with User Delegation client type.

 This client type applies to clients that act on behalf of a particular resource owner and require delegation of that user's authority to access the protected resource. This client type can interact with a separate web browser application to facilitate