6.1 Required Attributes

As stated in Sec. 3 , the trust agreement establishes the set of attributes that the IdP provides to the RP and the purposes the RP has for those attributes. Some attributes are required to be available at the IdP. Some of the available attributes are mandatory to be provided to all RPs. Other attributes are available at the IdP but accessible only to RPs if stipulated in the trust agreement. Other attributes are optional for the IdP to have available, and likewise optional to be provided to RPs if stipulated in the trust agreement. The identity attributes found in the PIV identity account that are made available from a PIV IdP are not limited to those available from the PIV authentication certificate.

The following set of identity attributes SHALL be provided by a PIV IdP to every RP within any trust agreement for PIV federation:

• Subject Identifier: A unique identifier for the PIV identity account that is assigned by the IdP to the account for use by the RP. The subject identifier is part of the federated identifier (see Sec. 6.2.1 for additional requirements).

• Home Agency: A global identifier for the home agency associated with the PIV identity account (e.g., an agency’s domain name or a FASC-N agency code from [SP800-87] ).

• Organizational Affiliation: The organization or list of organizations with which the PIV identity account is affiliated using global identifiers for the organization (e.g., an agency’s domain name or a FASC-N agency code from [SP800-87] ). This can be the same as the home agency but may be different in practice. For example, an employee’s home agency may be the parent organization but their account is affiliated with the specific sub-organizations to which they are assigned.

• Last Updated: A timestamp that indicates when the available attributes in the PIV identity account were last updated at the IdP. (see Sec. 6.1.1 .) A PIV IdP SHALL have the following core identity attributes available as part of the 1030 1031 1032

1033 1034 1035

1036 1037 1038

1039 1040

1041

1042 1043

1044 1045

1046 1047 1048 1049 1050 1051

1052 1053

1054 1055 1056 1057

1058 1059 1060 1061 1062 1063 1064 1065 account and SHALL make those attributes available to an RP if stipulated in the trust agreement:

• Full Name: The full name of the subscriber that is suitable for display or addressing the subscriber at the RP. Individual portions of the name (e.g., a given name or family name) MAY also be made available separately.

A PIV IdP SHOULD have the following core identity attributes available as part of the account and SHOULD make those attributes available to an RP if stipulated in the trust agreement:

• Email address: The current email address for the subscriber as known by or issued by the IdP

• Physical Address: The physical address of the subscriber, typically an office address

• Phone Number: The current telephone number for the subscriber as known by or issued by the IdP

• Certificate Identifier: The identifier of the PIV authentication certificate (see Sec 6.2.3 )

Except as otherwise stated in Sec. 6.2 , the IdP SHOULD disclose attributes through an identity API rather than through the assertion itself. For example, in OpenID Connect, while it is possible to include subscriber attributes such as name and email within the ID token (the assertion), it is preferable to make such attributes available from the UserInfo Endpoint (an identity API). When attributes are available for a given account through more than one method at an IdP, the attribute values SHALL match.

A PIV IdP SHOULD allow for selective disclosure of attributes to different RPs, as determined by the authorized party listed in the trust agreement.

`6.1` Required Attributes

Title

Control