3.8.3 Alternative Authentication Processes

Before · SP 800-63C

After · SP 800-63C-4

Alternative Authentication Processes

Before · SP 800-63C

After · SP 800-63C-4

The RP MAY allow a subscriber to access their RP subscriber account using direct authentication processes by allowing the subscriber to add and remove authenticators in the RP subscriber account. The RP SHALL follow the requirements in [SP800-63B] to manage all alternative authenticators.

Since the RP is using the direct authentication model discussed in [SP800-63] , there is no federation transaction and therefore no FAL assigned.

If the RP allows this kind of access, the RP SHOULD disclose the following in the trust agreement to allow IdPs to make decisions regarding information shared with the RP:
• The process for adding and removing alternative authenticators in the RP subscriber account

• Any restrictions on authenticators that the subscriber can use to access the RP

• The AAL required for access to the subscriber account without a federation transaction

• The circumstances under which the RP will require the subscriber to authenticate with their IdP, such as the period of time since the last federation transaction

For additional considerations on providing notice to a subscriber about authenticator management events, see Sec. 4.6 of [SP800-63B] .

While it is possible for bound authenticators (see Sec. 3.16 ) to be used as an alternative authenticator for direct access to the RP, these uses are distinct from each other and an RP SHALL determine whether a given authenticator can be used in one or both scenarios.