NIST-IA-13 Identity Providers and Authorization Servers

Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: policy] using [Assignment: mechanisms].

Identity providers, both internal and external to the organization, manage the user, device, and NPE authenticators and issue statements, often called identity assertions, attesting to identities of other systems or systems components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to system or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. Authenticator management (to include credential management) is covered by IA-05.

• T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.004 Cloud Accounts • T1111 Multi-Factor Authentication Interception • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.003 Make and Impersonate Token • T1134.005 SID-History Injection • T1528 Steal Application Access Token • T1556 Modify Authentication Process • T1556.006 Multi-Factor Authentication • T1556.007 Hybrid Identity • T1556.009 Conditional Access Policies • T1606 Forge Web Credentials • T1606.002 SAML Tokens • T1621 Multi-Factor Authentication Request Generation • T1649 Steal or Forge Authentication Certificates