I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security Controls excel workbook and NIST SP 800-53r4) and note the requirement that "IA-2 (12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials" includes "Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12."

Is there a simple integration point on the IDP/customer side at which we can address a SAML 2 authentication request as part of the usual implementation of CAC systems? Or do we need to develop some alternative authentication flow for CAC users?

I see from looking at the CAC developer resources how the cards are used to authenticate into a workstation and to software clients installed on the systems.

I've found an enthusiastic powerpoint explaining an OMB service that acts as a CAC-SAML gateway, one mention that the service, Max Authentication, received FedRAMP approval, but no other evidence it's real. Indeed, to use the Max services you register and get an email telling you how to set your password.

There is at one stackoverflow post where someone notes that "my domain uses Common Access Cards w/ SAML authentication" which implies this is a wheel that has been invented.

Thanks for your advice, judith

  • Are you asking if there would already be a system in place for CAC users so it can federate with your SP? – Steve Aug 7 '15 at 18:22
  • @Steve Our customer could be a library at a military base. While i would be delighted with a system that any CAC user could use to authenticate through a SAML2 system, it would be sufficient if the library deployed a solution local to their community. == I suppose another way of asking my question is how do cloud services that use SAML2 to authenticate meet the FedRAMP PIV requirement for CAC? – judielaine Aug 10 '15 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.