BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.1 Federated Identifier

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded 6 Protocol Requirements 996 part of 6.2

Title

Federated Identifier

Control

The assertion created by a PIV IdP includes a federated identifier for the PIV identity account, as defined in [SP800-63C] . The federated identifier consists of the logical combination of both a subject identifier for the PIV identity account assigned by the IdP and a global issuer identifier for the IdP.

The subject identifier SHALL be unique to the PIV identity account at the IdP such that no identifier is the same for any two PIV identity accounts at an IdP.

The subject identifier SHALL be stable for a PIV identity account over time and SHALL survive common life cycle events, such as reissuance of a PIV Card or changes to attributes (e.g., email addresses, usernames).

The subject identifier MAY be generated by the IdP in a pairwise fashion for a specific RP, as discussed in [SP800-63C] . If such a pairwise identifier is used, it SHALL be used consistently with a given RP and SHALL NOT be used for multiple RPs except as allowed by [SP800-63C] .

The subject identifier SHALL NOT include any personally identifiable or private information, such as a username, an certificate identifiers (see Sec 6.2.3 ), email addresses, the UUIDs of the PIV Card or cardholder, or an internal record number. These identifiers MAY be used as input to a one-way cryptographic function used to calculate a subject identifier. However, care should be taken to ensure that the resulting identifier is stable.

The issuer identifier SHALL be globally unique for the IdP. This identifier is usually the URL of the IdP, but it can also be a unique key identifier or other globally unique value that can be verified by the RP as part of the assertion.

The RP SHALL use this federated identifier to uniquely associate the PIV identity account with the RP subscriber account, as defined in [SP800-63C] . The RP SHALL NOT use other attributes alone for this purpose, including email addresses, certificate subject names, or PIV cardholder UUIDs.