BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Architecture 405

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded 2 Architecture 405

Title

Architecture 405

Control

406

407 408 409 410 411 412

413

414

415 416

417 418 419 This section is informative.

PIV federation is the process by which a subscriber uses their PIV identity account to access an RP using an IdP for that account. As shown in Figure 1 , the subscriber uses their PIV credentials (either a PIV Card or a derived PIV credential) to authenticate to the IdP and access the PIV identity account. The authentication event is then conveyed to the RP using an assertion that contains a set of attributes about the authentication event and the PIV identity account.

Fig. 1. PIV Federation PIV Credentials

Session Management Identity Information Redirects

Subscriber PIV Identity Accounts PIV IdP

IdP

Additional RPs RP

For PIV federation to occur, all of the following conditions apply:

• The account being asserted is a valid and active PIV identity account (see Sec. 2.1 ).

• The RP has established the IdP as the PIV IdP for the account through a valid and current trust agreement (see Sec. 2.2.1 ).

• The subscriber authenticates to the IdP using a PIV credential (see Sec. 2.1.1 ) or has provisioned the subscriber-controlled wallet by authenticating with a PIV credential (see Sec 2.2.3 ). If any of these items are not true, such as the use of a non-PIV identity account at a PIV- 420 421 422 423 424

425

426

427

428 429

430 431

432

433 434

435 436 437 438 439 440

441 442 443 444 445 446 447 448

449 450 enabled IdP or the authentication of a PIV identity account through an IdP that is not the PIV IdP for the account, then the transaction does not meet the requirements of PIV federation, and therefore the definitions and requirements in this document do not apply.

A successful PIV federation transaction is, roughly, as follows:

1. The subscriber starts in an unauthenticated state at the RP.

2. The RP requests a federated login at the IdP.

3. The subscriber authenticates to the IdP using a PIV credential (i.e., a PIV Card or derived PIV credential).

4. The IdP generates an assertion that represents the subscriber’s PIV identity account to the RP.

5. The RP receives the assertion and processes it.

6. The RP creates an authenticated session for the subscriber. At the establishment of this session, the subscriber is logged in to the RP.