BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.5.2 Federated Digital Identity Model With General-Purpose IdP (was: SP 800-63-2)

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
modified 2 Continuous improvement programs. Establishing a continuous evaluation part of 2.5

Title changed

Before · SP 800-63-3

SP 800-63-2

After · SP 800-63-4

SPFederated 800-63-2Digital Identity Model With General-Purpose IdP

Control changed

Before · SP 800-63-3

NIST SP 800-63-2 was a limited update of SP 800-63-1 and substantive changes were made only in Section 5, Registration and Issuance Processes . The substantive changes in the revised draft were intended to facilitate the use of professional credentials in the identity proofing process, and to reduce the need to send postal mail to an address of record to issue credentials for level 3 remote registration. Other changes to Section 5 were minor explanations and clarifications.

After · SP 800-63-4

NISTFig. SP4. 800-63-2Federated wasDigital aIdentity limitedModel updateExample ofVerifier

CSP SPSubject 800-63-1RP

IdP 1

2 4 3 6

Identity Proofing and substantiveEnrollment

Authenticator changesEnrollment were/ madeIssuance onlyFederation inRequest

Authentication SectionProcess Authenticated Session

Federation Protocol 5 Subject Roles Applicant

Claimant Subscriber

Subscriber Accounts

Figure 4 shows an example of those same common interactions in a federated model.

• Step 1: An applicant applies to a CSP through an identity proofing and enrollment process. The CSP identity-proofs that applicant.
• Step 2: Upon successful identity proofing, Registrationthe applicant is enrolled in the identity service as a subscriber.

– A subscriber account and Issuancecorresponding Processesauthenticators are established between the CSP and the subscriber. – The substantiveIdP changesis inprovisioned either directly by the revisedCSP draftor wereindirectly intendedthrough access to facilitateattributes of the usesubscriber ofaccount. professionalThe credentialsCSP maintains the subscriber account, its status, and the enrollment data collected in accordance with the identityrecords proofingretention processand disposal requirements described in Sec. 3.1 of [SP800-63A] . The subscriber maintains their authenticators. The IdP maintains its view of the subscriber account, any federated identifiers assigned to the subscriber account, and any policies and decisions regarding the release of attributes and information to reduceRPs. The usual sequence of interactions involved in using one or more authenticators in the needfederated model to sendperform postaldigital mailauthentication is as follows:

• Step 3: The RP requests that the claimant authenticate and requests any attributes needed from the IdP to make access or authorization decisions. This triggers a request for federated authentication to the IdP.

• Step 4: The claimant proves possession and control of the authenticators to the verifier function of the IdP through an addressauthentication process.

– The binding of recordthe claimant’s authenticators are verified with those bound to issuethe credentialsclaimed subscriber account and optionally to obtain additional subscriber attributes.

• Step 5: The RP and the IdP communicate through a federation protocol. The IdP provides an assertion and any necessary additional attributes to the RP through a federation protocol. The RP verifies the assertion to establish confidence in the identity and attributes of a subscriber for levelaccess 3to remotean registrationonline service at the RP. OtherRPs changesuse a subscriber’s federated identity (pseudonymous or non-pseudonymous), IAL, AAL, FAL, and other factors to Sectionmake 5authorization weredecisions.

• minorStep explanations6: An authenticated session is established between the subscriber and clarificationsthe RP.