+4.3 Trust Agreements
---+4.3.1 Pre-Established Trust Agreements
---+4.3.2 Subscriber-Driven Trust Agreement Establishment

4.3 Trust Agreements

Trust agreements for general-purpose IdPs are generally expected to be established between the RP and the IdP, where the RP relies on the identity of the IdP to provide the basis of trust for federation transactions. It is expected that the trust agreement between the CSP and IdP is established independent of the federation transaction.

Trust agreements for general-purpose IdPs SHALL be established either:

As the result of an agreement by the federated parties prior to the federation transaction or
As the result of decision or action by the subscriber during the federation transaction

1. Přehled

4.3.1 Pre-Established Trust Agreements

When the trust agreement is established by the federated parties prior to the federation transaction, the trust agreement SHALL establish the following terms:

The set of subscriber attributes, derived attributes, and attribute bundles that the IdP can make available to the RP
The attribute storage policy of the IdP for the subscriber account, including any available means for the subscriber to request deletion
Any attribute sources from which the IdP receives applicable subscriber attributes, derived attributes, and attribute bundles, including the CSP
Any identity APIs that are made available by the IdP, either directly or through an external provider, and which subscriber attributes are available at these APIs
The population of subscriber accounts for which the IdP can create assertions
Any additional uses of subscriber information beyond providing the identity service
The set of subscriber attributes, derived attributes, and attribute bundles that the RP is allowed to request (i.e., a subset of the attributes made available)
The purpose for each attribute requested by the RP
The provisioning models used by the RP for RP subscriber accounts
The authorized party responsible for decisions regarding the release of subscriber attributes to the RP (e.g., the IdP organization, the subscriber)
The process and techniques used to inform subscribers about attribute sharing
The process and techniques for collecting consent from the authorized party when necessary
The xALs available from the IdP
The xALs required by the RP

The terms of the trust agreement SHALL be available to the operators of the RP and the IdP upon its establishment. The terms of the trust agreement SHALL be made available to subscribers upon request to the IdP or RP.

The IdP and RP SHALL each assess their respective redress mechanisms for efficacy in resolving complaints or problems and disclose the results of this assessment as part of the trust agreement. See Sec. 3.5.3 for additional requirements and considerations for redress mechanisms.

If FAL3 is allowed within the trust agreement, the trust agreement SHALL stipulate the following terms regarding holder-of-key assertions (see Sec. 3.15) and bound authenticators (see Sec. 3.16):

The means by which holder-of-key assertions can be verified by the RP (such as a common trusted PKI system)
The means by which the RP can associate holder-of-key assertions with specific RP subscriber accounts (such as attribute-based account resolution or pre-provisioning)
Whether bound authenticators are supplied by the RP or the subscriber
Documentation of the binding ceremony used for any subscriber-provided bound authenticators

If shared signaling is used by the IdP or RP (see Sec. 4.8), the terms of the trust agreement SHALL establish:

The events that trigger a signal to be sent
Which signals are sent for each trigger
The information included in each signal
The expected behavior of the party receiving the signal

Runtime decisions at the IdP (see Sec. 4.6.1.3), MAY be used to further limit which subscriber attributes are sent between parties in the federated transaction (e.g., a runtime decision could opt to not disclose an email address, even though this attribute was included in the terms of the trust agreement).

The trust agreement SHALL be reviewed periodically to ensure that it is still fit for purpose and to avoid unnecessary data exchange and the over-collection of subscriber data.
4.3.2 Subscriber-Driven Trust Agreement Establishment

When the trust agreement is established as the result of a subscriber’s decision (e.g., a subscriber starting a federation transaction between an RP and their IdP without an established agreement), the trust agreement is anchored by the subscriber. In a subscriber-driven trust agreement, the trust agreement takes the form of a set of terms of use as opposed to a formal contract between parties. Consequently, the following terms SHALL be disclosed to the subscriber upon request:

Any attribute sources from which the IdP receives applicable subscriber attributes, including the CSP
Any identity APIs that are made available by the IdP, either directly or through an external provider, and which subscriber attributes are available at these APIs
The set of subscriber attributes, derived attributes, and attribute bundles that the IdP can make available to the RP
The attribute storage policy of the IdP for the subscriber account, including any available means for the subscriber to request deletion
The use of any shared signaling between the IdP and RP
The population of subscriber accounts for which the IdP can create assertions
Any additional uses of subscriber information beyond providing the identity service
The xALs available from the IdP
The xALs required by the RP

The IdP SHALL assess its redress mechanisms for efficacy in resolving complaints or problems and disclose the results of this assessment to the subscriber. See Sec. 3.5.3 for additional requirements and considerations for redress mechanisms.

The release of subscriber attributes SHALL be managed using a runtime decision at the IdP, as described in Sec. 4.6.1.3. The authorized party SHALL be the subscriber.

The following terms of the trust agreement SHALL be disclosed to the subscriber during the runtime decision:

The set of subscriber attributes, derived attributes, and attribute bundles that the RP will request (i.e., a subset of the attributes made available by the IdP)
The purpose for each attribute requested by the RP
The attribute storage policy of the RP for the RP subscriber account, including any available means for the subscriber to request deletion

All information disclosed to the subscriber needs to be conveyed in a manner that is understandable and actionable, as discussed in Sec. 8.

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.