BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.4 Shared Signaling

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded 3 Trust Agreements 574 part of 3

Title

Shared Signaling

Control

In addition to sharing account information for the purposes of federated login, additional signals can be shared between the IdP and RP for the specific uses described in [SP800-63C] .

The IdP SHOULD inform the RP of significant status changes in a PIV identity account that has been used at an RP, including:

• A suspected breach of the PIV identity account,

• The termination of the PIV identity account, or

• Changes to any part of the federated identifier.

When the RP receives such status changes, the RP SHALL update its RP subscriber account as specified by the trust agreement.

The IdP MAY additionally inform the RP of significant changes to the PIV identity account’s information, including:

• A change in contact information attributes (email address, phone number),

• A change in primary authenticator status, or

• The addition or removal of secondary authenticator.

The RP SHOULD inform the IdP of significant status changes in the RP subscriber account, including:

• A suspected breach of the RP subscriber account or its data,

• Suspicious behavior of the RP subscriber account (e.g., repeated attempts to access unauthorized functions), or

• The addition or removal of RP-managed bound authenticators at FAL3.

When the IdP receives such a signal, the IdP SHALL update the account as specified by the trust agreement.