4.4 Federation and Assertions
All changes in this version
Title changed
Before · SP 800-63-3
Federation and Assertions
After · SP 800-63-4
Federation and Assertions
Control changed
Before · SP 800-63-3
Normative requirements can be found in SP 800-63C , Federation and Assertions .
Overall, SP 800-63 does not presuppose a federated identity architecture; rather, these guidelines are agnostic to the types of models that exist in the marketplace, allowing agencies to deploy a digital authentication scheme according to their own requirements. However, identity federation is preferred over a number of siloed identity systems that each serve a single agency or RP.
Federated architectures have many significant benefits, including, but not limited to:
• Enhanced user experience. For example, an individual can be identity proofed once and reuse the issued credential at multiple RPs.
• Cost reduction to both the user (reduction in authenticators) and the agency (reduction in information technology infrastructure).
• Data minimization as agencies do not need to pay for collection, storage, disposal, and compliance activities related to storing personal information.
• Pseudonymous attribute assertions as agencies can request a minimized set of attributes, to include claims, to fulfill service delivery.
• Mission enablement as agencies can focus on mission, rather than the business of identity management.
The following sections discuss the components of a federated identity architecture should an agency elect this type of model.
After · SP 800-63-4
Normative requirements can be found in SP 800-63C , Federation and Assertions .
Overall, SP 800-63 does not presuppose a federated identity architecture; rather, these guidelines are agnostic to the types of models that exist in the marketplace, allowing agencies to deploy a digital authentication scheme according to their own requirements. However, identity federation is preferred over a number of siloed identity systems that each serve a single agency or RP.
Federated architectures have many significant benefits, including, but not limited to:
• Enhanced user experience. For example, an individual can be identity proofed once and reuse the issued credential at multiple RPs.
• Cost reduction to both the user (reduction in authenticators) and the agency (reduction in information technology infrastructure).
• Data minimization as agencies do not need to pay for collection, storage, disposal, and compliance activities related to storing personal information.
• Pseudonymous attribute assertions as agencies can request a minimized set of attributes, to include claims, to fulfill service delivery.
• Mission enablement as agencies can focus on mission, rather than the business of identity management.
The following sections discuss the components of a federated identity architecture should an agency elect this type of model.