BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

A.5 PIV Federation Proxy as a Federation Authority

NIST PIV and digital identity SP 800-217 (Draft)
All changes in this version
first version loaded Appendix A Examples 1221 part of A

Title

PIV Federation Proxy as a Federation Authority

Control

A federation proxy is set up within a multilateral federation. The proxy is run by the federation authority. All IdPs under the multilateral agreement register the proxy as an RP. The RPs within the federation authority connect to the proxy as their only IdP. All federation transactions within the multilateral federation flow through the proxy.

The federation authority discloses the nature of the proxy to all parties, so the IdPs know that this particular RP is a proxy, and the RPs know that their IdP is a proxy. Furthermore, the proxy lists all of the upstream IdPs and their associated populations of PIV identity accounts to all RPs connecting through the proxy. The proxy discloses to the RPs which upstream IdPs participated in the authentication of 1332 1333 1334 1335

1336 1337

1338 1339 1340 1341 1342 1343

1344 1345 1346 1347 1348 1349 1350 1351

1352 1353 1354 1355

1356 1357 1358 1359

1360 1361 1362 1363 1364 1365 1366 the PIV identity account to the proxy, allowing the downstream RPs to validate that the source of the federation transaction through the proxy is appropriate for the PIV identity account in question.

The proxy is not regarded as a home agency IdP for any RP in the system, even if the IdPs connecting to the proxy are themselves home agency IdPs.