BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3 Common Federation Requirements (was: The agency SHALL consult with their SAOP to conduct an analysis determining)

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
modified 3 Common Federation Requirements

Title changed

Before · SP 800-63C

The agency SHALL consult with their SAOP to conduct an analysis determining

After · SP 800-63C-4

The agency SHALL consult with their SAOP to conduct anCommon analysisFederation determiningRequirements

Control changed

Before · SP 800-63C

whether the requirements of the E-Government Act are triggered by the agency that is acting as an IdP, the agency that is acting as an RP, or both.

After · SP 800-63C-4

whetherThis section is normative.

A federation transaction allows the requirementssubscriber to establish an authenticated session with the RP based on a subscriber account known to the IdP. The federation transaction can also provide the RP with a set of identity attributes associated with the E-Governmentauthenticated Actsession. areThe triggeredauthenticated session can then be used by the agencyRP for activities to support use cases, such as the following:

• Logging in the subscriber to access functionality at the RP

• Identifying the subscriber based on presented attributes

• Processing the subscriber attributes presented in the federation transaction

A federation transaction requires relatively complex multi-party protocols that have subtle security and privacy characteristics. When evaluating a particular federation protocol, profile, or deployment structure, it is actingoften asinstructive anto break it down into its component relationships and evaluate the needs for each of them:

• The subscriber to the CSP

• The CSP to the IdP

• The subscriber to the IdP

• The IdP to the RP

• The subscriber to the RP

In addition, the agencysubscriber often interacts with the CSP, IdP, and RP through a user agent (e.g., a web browser) that is, actingas a result, involved in the federation process. While the actions of the subscriber described throughout these guidelines can optionally be performed through a user agent, a user agent is not necessary for all types of applications and interactions (e.g., native applications). When necessary, requirements on the user agent are called out directly.

Each party in a federation protocol bears specific responsibilities and expectations that must be fulfilled in order for the federated system to function as intended.

Federation transactions are comprised of three separate but related elements:

Trust Agreements: The establishment of a policy decision that allows the CSP, IdP, and RP to connect for the purposes of federation. This policy is governed by a set of terms that establish the permission to connect. Identifier and Key Establishment: The association of cryptographic keys and identifiers for the CSP, IdP, and RP that take part in the federation transaction. This process enables the parties to identify each other securely for future exchanges.

Federation Protocol: The verification of the subscriber’s identity by the IdP and subsequent issuance of an assertion to the RP. This results in the passing of subscriber attributes to the RP and establishing an authenticated session for the subscriber at the RP.

These elements all need to be fulfilled for a federation process to be complete. The exact order in which that happens and which parties are involved in which steps can vary depending on the deployment model, orprotocol bothchoices, and other factors.