BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

7 Federation Considerations

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
removed 7 Federation Considerations

Title changed

Before · SP 800-63-3

Federation Considerations

After · SP 800-63-4

Federation Considerations

Control changed

Before · SP 800-63-3

This section is informative.

This guideline and its companion volumes are agnostic to the authentication and identity proofing architecture an agency selects. However, there are scenarios an agency may encounter that make identity federation potentially more efficient and effective than establishing identity services local to the agency or individual applications. The following list details scenarios where, if any apply, the agency may consider federation a viable option. This list does not take into consideration any economic benefits or weaknesses of federation vs. localized identity architectures.

Federate authenticators when:

1. Potential users already have an authenticator at or above required AAL. 2. Multiple credential form factors are required to cover all possible user communities. 3. Agency does not have infrastructure to support authentication management (e.g., account recovery, authenticator issuance, help desk).

After · SP 800-63-4

This section is informative.

This guideline and its companion volumes are agnostic to the authentication and identity proofing architecture an agency selects. However, there are scenarios an agency may encounter that make identity federation potentially more efficient and effective than establishing identity services local to the agency or individual applications. The following list details scenarios where, if any apply, the agency may consider federation a viable option. This list does not take into consideration any economic benefits or weaknesses of federation vs. localized identity architectures.

Federate authenticators when:

1. Potential users already have an authenticator at or above required AAL. 2. Multiple credential form factors are required to cover all possible user communities. 3. Agency does not have infrastructure to support authentication management (e.g., account recovery, authenticator issuance, help desk).