Federation preserves authority boundaries

SPIFFE federation distributes trust bundles for named trust domains through configured bundle endpoints and authentication profiles. A verifier needs to know which domain the retrieved bundle belongs to and why it trusts that endpoint. A valid HTTPS response from some server does not automatically authorize it to supply another domain's roots. Preserve the configured endpoint-profile-domain binding when storing and disseminating bundles, and follow the supported bootstrap and rotation rules of the selected profile.

Federated token validation similarly needs an exact trusted issuer and its supported key-discovery contract. Do not let an incoming token invent a new issuer or key endpoint that the verifier automatically trusts. Discovery retrieves metadata within a preauthorized relationship; it is not a grant of authority to every reachable URL. Key selection, audience, subject semantics, and algorithm rules still apply. A successful foreign signature check remains an authentication result whose authorization scope must be separately defined.

Map foreign issuer-subject pairs to local roles or principals under an explicit allow-list or constrained rule. Mapping every subject named admin to a local administrator merges unrelated namespaces and lets a foreign naming convention define local privilege. Include environment, tenant, and stable subject semantics where required, and consider what happens if the foreign issuer reassigns a subject. Federation may depend on an external authority whose compromise or configuration mistake now affects a local resource.

A many-to-one mapping can be intentional, such as several service replicas assuming one narrow reader role, but its audit and containment costs remain. Preserve original validated actor and issuer information where the protocol supports it. Removing a federation relationship must also address already issued local tokens and sessions; deleting the trust configuration does not necessarily invalidate every artifact derived earlier. Test both direct foreign authentication and any token-exchange path that creates a new local credential.

Fetch and refresh foreign trust material with authenticated transport and bounded caching appropriate to the specification. During rotation, overlap and retirement need coordinated validation so legitimate workloads continue and removed roots actually stop being trusted. A failed fetch should follow a defined cached-trust and expiry policy, not disable signature checking. Observe bundle age, accepted issuer set, rejected foreign principals, and derived local credentials without retaining reusable secret contents in logs.

The reliability lab provides only an availability contrast. Reset and set both n=5, k=2, predict three up with majority three, then inspect. Reset and re-set n=5, k=3 to predict only two up. It models replica counts, not trust bundles or federated agreement. Enough available endpoints do not establish that a bundle belongs to the named domain, and a majority count does not authorize foreign subjects. State the missing cryptographic binding and local mapping before discussing availability tradeoffs.