IA-02(12) Acceptance of PIV Credentials
Control statement
Accept and electronically verify Personal Identity Verification-compliant credentials.
Guidance
Acceptance of Personal Identity Verification (PIV)-compliant credentials applies to organizations implementing logical access control and physical access control systems. PIV-compliant credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. The adequacy and reliability of PIV card issuers are authorized using SP 800-79-2. Acceptance of PIV-compliant credentials includes derived PIV credentials, the use of which is addressed in SP 800-166. The DOD Common Access Card (CAC) is an example of a PIV credential.
Implementation
Keycloak customer sign-in (canary)
PIV credentials: the template maps a CAC/PIV certificate (SAN UPN) to a user with OCSP checking, fail-closed. Planned: the truststore (DoD/FPKI CAs) and https-client-auth are not configured on the instance and the realm is not imported; nothing tested with a card.
Status: planned.
Evidence:
All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).