Federation Assurance Level (FAL)
NIST 800-63C levels describing how strongly a federated login protects the assertion an identity provider (IdP) sends to a relying party (RP). FAL1: the IdP signs the assertion with approved cryptography and restricts its audience. FAL2: adds strong protection against assertion injection, limits each assertion to a single RP, and requires a trust agreement set up before the transaction. FAL3: the RP also verifies that the subscriber controls an authenticator, through a holder-of-key assertion or a bound authenticator. Defined in NIST SP 800-63C-4.
FAL is the level teams forget to write down. A program can demand AAL3 at the IdP and then hand the result to every application as a bearer SAML assertion or ID token, which an attacker who steals it can replay without ever touching the hardware key. The practical line in Revision 4 sits at FAL2, where injection protection means the RP must start the federation transaction, so unsolicited IdP-initiated responses no longer qualify. FAL3 closes the replay gap the same way proof of possession does for OAuth tokens: the assertion is only useful alongside a phishing-resistant authenticator the user holds.
See also: NIST 800-63, AAL, IAL, identity federation, SAML 2.0
Related on Start with Identity
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- GlossaryOSCAL (Open Security Controls Assessment Language)
OSCAL (Open Security Controls Assessment Language) is a NIST-led set of machine-readable formats, in XML, JSON and YAML, for writing down security controls and
- GlossaryCJIS Security Policy
The CJIS Security Policy is the FBI's set of minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information
- TechniqueFederation trust abuse and SAML forgery
A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature valida
- GuideIdentity Federation Implementation Guide: Protocols, Trust, and Cross-Domain SSO
A step-by-step guide to implementing identity federation covering SAML, OIDC, and WS-Federation protocols, trust relationship configuration, attribute mapping,
- ArticleIdentity for Government: National eIDs, Assurance Levels, and Access
How identity works in the public sector: national eID schemes and citizen login, identity assurance levels under NIST 800-63 and eIDAS, workforce credentials li