BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.1 Federation Models

NIST PIV and digital identity SP 800-63C-4 against SP 800-63C
All changes in this version
added 3 Common Federation Requirements part of 3

Title changed

Before · SP 800-63C

After · SP 800-63C-4

Federation Models

Control changed

Before · SP 800-63C

After · SP 800-63C-4

These guidelines provide requirements for two models of federation: general-purpose IdPs and subscriber-controlled wallets. Subscriber-controlled wallets can in turn be hosted on a device that is controlled by the subscriber or on a remote-hosted system that is operated on behalf of the subscriber. The models are generally distinguished by the way in which the contents of the subscriber account are made available to the federation system. In a general-purpose IdP, the subscriber account is made available in whole or in part by the CSP through an action that does not usually involve the subscriber. In a subscriber-controlled wallet, the subscriber account is made available by the CSP through the issuance of attribute bundles.

Requirements that are specific to general-purpose IdPs, such as a multi-account identity provider hosted by an organization, are discussed in Sec. 4 . Requirements that are specific to subscriber-controlled wallets, such as an on-device digital wallet software or a cloud-hosted wallet provider, are discussed in Sec. 5 . All other requirements, including the general requirements in Sec. 3 , apply to both models unless otherwise specified. The different models of federation systems fulfill trust and information requirements in different ways.

Table 2 provides a non-normative list of requirements for different models of federated systems and illustrates where core pieces of information are communicated in either an assertion from the IdP or an attribute bundle from the CSP. If a federation implementation has aspects of both models, then the relevant portions of the section in question apply. Table 2. Federation models

Requirement Location General-Purpose IdP Subscriber-controlled Wallet IdP issuer identifier Assertion Required Optional IdP issuer identifier Attribute bundle Optional Optional IdP verification key Attribute bundle Optional Required Subject identifier Assertion Required Optional Subject identifier Attribute bundle Optional Required unless ephemeral provisioning or account resolution are used CSP issuer identifier Attribute bundle Required Required