IA-09 Service Identification and Authentication
Control statement
Uniquely identify and authenticate [Assignment: system services and applications] before establishing communications with devices, users, or other services or applications.
Guidance
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Implementation
SPIRE (canary)
Services are identified by SPIFFE IDs issued by SPIRE: the server is running and an agent is ready on every scheduled node. Partial: canary only, and the check proves availability, not that every workload authenticates with its SVID.
Status: partial.
Evidence:
OpenBao SPIFFE JWT auth and policies (canary)
Agents authenticate to OpenBao with their SPIRE JWT-SVID; the role binds the exact SPIFFE ID and the audience. Partial and manual: the jwt mount and roles are OpenBao state, not visible to the read-only Kubernetes evidence identity; the evidence is the declared self-init config, not checked live by the job. One agent only.
Status: partial.
Evidence:
- https://github.com/zeta-reticuli-inc/talos-platform/blob/main/clusters/proxmox-canary/openbao/helmrelease.yaml
- https://github.com/zeta-reticuli-inc/agents/blob/main/deploy/base/openbao/jwt-role-agent-canary-15-2041.00.json
- Manual check: bao auth list; bao read auth/jwt/role/agent-canary-15-2041.00 (manual, as platform-admin)
SPIRE agent workload identity (canary)
Every agent is identified by its derived SPIFFE ID: every /onet/ ClusterSPIFFEID matches the derivation rule, is limited to its tenant namespace, selects a pod, and has no entry failures. Partial: canary, one agent; proves the registration, not that every call the agent makes uses its SVID.
Status: partial.
Evidence:
All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).