BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 Introduction (was: The agency SHALL consult with their Senior Agency Official for Privacy)

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
modified 1 Introduction

Title changed

Before · SP 800-63C

The agency SHALL consult with their Senior Agency Official for Privacy

After · SP 800-63C-4

The agency SHALL consult with their Senior Agency Official for PrivacyIntroduction

Control changed

Before · SP 800-63C

(SAOP) to conduct an analysis determining whether the requirements of the Privacy Act are triggered by the agency that is acting as an IdP, by the agency that is acting as an RP, or both (see Section 9.4 ).

After · SP 800-63C-4

This section is informative.

Federation is the process of authenticating a subscriber to a relying party (SAOPRP) towithout conductthe anRP analysisdirectly determiningverifying whetherthe subscriber’s authenticators. An identity provider (IdP) makes the requirementssubscriber ofaccount defined in [SP800-63A] available to the PrivacyRP Actthrough area federation protocol. The IdP sends an assertion triggered by an authentication event of the agencysubscriber thatto the RP. An assertion is actinga asverifiable anstatement about the subscriber account to the RP. The RP verifies the assertion provided by the IdP, bycreates an authenticated session with the agencysubscriber, thatand isgrants actingthe subscriber access to the RP’s functions.

The IdP works in one of two modes:

• As a verifier for authenticators bound to the subscriber account, as andescribed RPin [SP800-63B] (see details in Sec. 4 ), or

• bothAs software on a subscriber-controlled device (often known as a digital wallet) or a hosted service (often known as a cloud wallet) that is issued signed attribute bundles by the CSP (see Sectiondetails 9in Sec.4 5 ).

The federation process allows the subscriber to obtain services from multiple RPs without the need to hold or maintain separate authenticators at each RP. This process is sometimes known as single sign-on . The federation process is also generally the preferred approach to authentication when the RP and the subscriber account are not administered together under a common security domain, as it eliminates the need for the RP to issue an additional authenticator for the subscriber to manage. Even so, federation can be still applied within a single security domain for a variety of benefits, including centralized account management and technical integration.

The federation process can be facilitated by additional parties acting in other roles, such as a federation authority to facilitate the trust agreements in place and federation proxies to facilitate the protocol connections.