Release/1.21.0

docs/includes/archives

@@ -9,6 +9,11 @@
 </tr>
 </thead><tbody>
 <tr>
+<td><a href='https://consumerdatastandardsaustralia.github.io/standards-archives/standards-1.20.0/'>13/11/2022</a></td>
+<td>1.20.0</td>
+<td><a href='https://consumerdatastandardsaustralia.github.io/standards-archives/standards-1.20.0/'>Changes arising from Decision 259 (Maintenance iteration 12)</a></td>
+</tr>
+<tr>
 <td><a href='https://consumerdatastandardsaustralia.github.io/standards-archives/standards-1.19.0/'>13/09/2022</a></td>
 <td>1.19.0</td>
 <td><a href='https://consumerdatastandardsaustralia.github.io/standards-archives/standards-1.19.0/'>Changes arising from Decision 260 (Energy Closed Accounts)</a></td>

docs/includes/cds_dcr

@@ -98,12 +98,15 @@
     </span><span class="s2">"client_credentials"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"response_types"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
-    </span><span class="s2">"code id_token"</span><span class="w">
+    </span><span class="s2">"code"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"application_type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"web"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A256GCM"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A128CBC-HS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"request_object_signing_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_statement"</span><span class="p">:</span><span class="w"> </span><span class="s2">"string"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_id"</span><span class="p">:</span><span class="w"> </span><span class="s2">"740C368F-ECF9-4D29-A2EA-0514A66B0CDE"</span><span class="p">,</span><span class="w">
@@ -241,12 +244,15 @@ This operation does not require authentication
     </span><span class="s2">"client_credentials"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"response_types"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
-    </span><span class="s2">"code id_token"</span><span class="w">
+    </span><span class="s2">"code"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"application_type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"web"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A256GCM"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A128CBC-HS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"request_object_signing_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_statement"</span><span class="p">:</span><span class="w"> </span><span class="s2">"string"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_id"</span><span class="p">:</span><span class="w"> </span><span class="s2">"740C368F-ECF9-4D29-A2EA-0514A66B0CDE"</span><span class="p">,</span><span class="w">
@@ -422,12 +428,15 @@ To perform this operation, you must be authenticated and authorised with the fol
     </span><span class="s2">"client_credentials"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"response_types"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
-    </span><span class="s2">"code id_token"</span><span class="w">
+    </span><span class="s2">"code"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"application_type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"web"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A256GCM"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A128CBC-HS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"request_object_signing_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_statement"</span><span class="p">:</span><span class="w"> </span><span class="s2">"string"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_id"</span><span class="p">:</span><span class="w"> </span><span class="s2">"740C368F-ECF9-4D29-A2EA-0514A66B0CDE"</span><span class="p">,</span><span class="w">
@@ -680,12 +689,15 @@ To perform this operation, you must be authenticated and authorised with the fol
     </span><span class="s2">"client_credentials"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"response_types"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
-    </span><span class="s2">"code id_token"</span><span class="w">
+    </span><span class="s2">"code"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"application_type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"web"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A256GCM"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A128CBC-HS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"request_object_signing_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_statement"</span><span class="p">:</span><span class="w"> </span><span class="s2">"string"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_id"</span><span class="p">:</span><span class="w"> </span><span class="s2">"740C368F-ECF9-4D29-A2EA-0514A66B0CDE"</span><span class="p">,</span><span class="w">
@@ -826,7 +838,7 @@ To perform this operation, you must be authenticated and authorised with the fol
 <td>response_types</td>
 <td>[string]</td>
 <td>mandatory</td>
-<td>Array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint.</td>
+<td>Array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint.<br><br>Response type value <code>code</code> is required for Authorization Code Flow. Response type value <code>code id_token</code> is required for OIDC Hybrid Flow.</td>
 </tr>
 <tr>
 <td>application_type</td>
@@ -837,7 +849,7 @@ To perform this operation, you must be authenticated and authorised with the fol
 <tr>
 <td>id_token_signed_response_alg</td>
 <td>string</td>
-<td>optional</td>
+<td>mandatory</td>
 <td>Algorithm with which an id_token is to be signed</td>
 </tr>
 <tr>
@@ -853,6 +865,24 @@ To perform this operation, you must be authenticated and authorised with the fol
 <td>JWE <code>enc</code> algorithm with which an id_token is to be encrypted</td>
 </tr>
 <tr>
+<td>authorization_signed_response_alg</td>
+<td>string</td>
+<td>optional</td>
+<td>The JWS <code>alg</code> algorithm required for signing authorization responses. If this is specified, the response will be signed using JWS and the configured algorithm. The algorithm “none” is not allowed.<br><br>Required if response_type of “code” is registered by the client.</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_alg</td>
+<td>string</td>
+<td>optional</td>
+<td>The JWE <code>alg</code> algorithm required for encrypting authorization responses. If unspecified, the default is that no encryption is performed.<br><br>Required if “authorization_encrypted_response_enc” is included.</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_enc</td>
+<td>string</td>
+<td>optional</td>
+<td>The JWE <code>enc</code> algorithm required for encrypting authorization responses. If “authorization_encrypted_response_alg” is specified, the default for this value is “A128CBC-HS256”.</td>
+</tr>
+<tr>
 <td>request_object_signing_alg</td>
 <td>string</td>
 <td>mandatory</td>
@@ -916,6 +946,10 @@ To perform this operation, you must be authenticated and authorised with the fol
 </tr>
 <tr>
 <td>response_types</td>
+<td>code</td>
+</tr>
+<tr>
+<td>response_types</td>
 <td>code id_token</td>
 </tr>
 <tr>
@@ -931,6 +965,30 @@ To perform this operation, you must be authenticated and authorised with the fol
 <td>ES256</td>
 </tr>
 <tr>
+<td>authorization_signed_response_alg</td>
+<td>PS256</td>
+</tr>
+<tr>
+<td>authorization_signed_response_alg</td>
+<td>ES256</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_alg</td>
+<td>RSA-OAEP</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_alg</td>
+<td>RSA-OAEP-256</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_enc</td>
+<td>A256GCM</td>
+</tr>
+<tr>
+<td>authorization_encrypted_response_enc</td>
+<td>A128CBC-HS256</td>
+</tr>
+<tr>
 <td>request_object_signing_alg</td>
 <td>PS256</td>
 </tr>
@@ -975,12 +1033,15 @@ To perform this operation, you must be authenticated and authorised with the fol
     </span><span class="s2">"client_credentials"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"response_types"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
-    </span><span class="s2">"code id_token"</span><span class="w">
+    </span><span class="s2">"code"</span><span class="w">
   </span><span class="p">],</span><span class="w">
   </span><span class="s2">"application_type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"web"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"id_token_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A256GCM"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_signed_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"RSA-OAEP"</span><span class="p">,</span><span class="w">
+  </span><span class="s2">"authorization_encrypted_response_enc"</span><span class="p">:</span><span class="w"> </span><span class="s2">"A128CBC-HS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"request_object_signing_alg"</span><span class="p">:</span><span class="w"> </span><span class="s2">"PS256"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_statement"</span><span class="p">:</span><span class="w"> </span><span class="s2">"string"</span><span class="p">,</span><span class="w">
   </span><span class="s2">"software_id"</span><span class="p">:</span><span class="w"> </span><span class="s2">"740C368F-ECF9-4D29-A2EA-0514A66B0CDE"</span><span class="p">,</span><span class="w">