I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security Controls excel workbook and NIST SP 800-53r4) and note the requirement that "IA-2 (12) Identification and Authentication (Organizational Users) | Acceptance of PIV Credentials" includes "Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12."
Is there a simple integration point on the IDP/customer side at which we can address a SAML 2 authentication request as part of the usual implementation of CAC systems? Or do we need to develop some alternative authentication flow for CAC users?
I see from looking at the CAC developer resources how the cards are used to authenticate into a workstation and to software clients installed on the systems.
I've found an enthusiastic powerpoint explaining an OMB service that acts as a CAC-SAML gateway, one mention that the service, Max Authentication, received FedRAMP approval, but no other evidence it's real. Indeed, to use the Max services you register and get an email telling you how to set your password.
There is at one stackoverflow post where someone notes that "my domain uses Common Access Cards w/ SAML authentication" which implies this is a wheel that has been invented.
Thanks for your advice, judith