Applicable Doc. 02 - IAM Conceptual Architecture.pdf
PDF 115 KB Posted
- Attached to
- DF01--IAM Recompete Task Order (VA-24-00001896)
- Solicitation number
- 36C10B24Q0109
About this file
The document provides a conceptual architecture diagram for an Identity, Credential and Access Management (IAM) system. The diagram depicts the internal and external interfaces, identity stores, service providers, and identity and access services involved in managing user access and provisioning across VA applications. Key components include the Master Person Index, various service providers for authentication such as Login.gov and ID.me, provisioning interfaces and on-boarding workflows, and interfaces to applications both inside and outside the VA network. The related federal contract opportunity is a recompete task order with solicitation number 36C10B24Q0109 to provide IAM services for the VA. The opportunity is pre-solicitation and is being conducted by the VA Technology Acquisition Center Austin.
View the file
Other files
Show all 34
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
VA Master Person
UI
SSOi
VHIC
getProofingStatusgetProofingStatus
Authentication TraitsAuthentication Traits
DS Logon
AccessVA
Prov
(includes
Provisioning UI)
VA Master Person
Index (MPI)
SSOe
Externally-Facing
VA Applications /
Portals
MHV CSP
ID.me
Login.gov
Redirects getCorrespondingIDs()
KEY
Session Mgmt
HL7 v3
LDAP
SAML
CAR
Connected to all AcS
Systems
Connected to all AcS
Systems
Non IAM
AcS
IdS
V4.9 06/22/2023
Authentication TraitsAuthentication Traits
VA Applications
Internally-Facing
VA Applications
Overall
STS
STS
AMS
Manage authorizationsManage authorizations
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
User Management (Adds, Updates)User Management (Adds, Updates)
AuthDB
3POB3POB
Last Access
SPML (update)SPML (update)
OIDC
Provision/Modify/Deprovision
Account/Access
Add/Update/Remove from AuthDB
DS Logon
AccessVA
Prov
VA Master Person
Index (MPI)
SSOe
ReverseProxy
Externally-Facing
VA Applications /
Portals
MHV CSP
ReverseProxy or
OAuth
Redirects
Authentication TraitsAuthentication Traits
LOA1
LOA2 (IPP & RP)
LOA2 (IPP)
External
STS
KEY
Session Mgmt
HL7 v3
LDAP
SAML
Non IAM
AcS
IdS
IPP = In-Person Proofing
RP = Remote Proofing
AMS
Veteran
Delegation Web
Client
Redirects searchforPerson (unattended) getRelationships() addRelationship() updateRelationship() searchforPerson (unattended) getRelationships() addRelationship() updateRelationship()
REST
Adapter
ID.meLOA3 (RP)
3POB3POB
3POB3POB
V4.9 06/22/2023
Login.govLOA3 (RP)
OIDC
Prov
VA Master Person
Index (MPI)
SSOi
VHIC
Internally-Facing
VA Applications getProofingStatusgetProofingStatus
Internal
STS
KEY
Session Mgmt
HL7 v3
LDAP
Non IAM
AcS
IdS
VA Master Person
UI
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
Authentication TraitsAuthentication Traits
AuthDB
V4.9 06/22/2023
Provisioning UI
Provision/Modify/Deprovision
Account/Access
Add/Update/Remove from AuthDB
Provision/Modify/Deprovision
Provisioning /
Onboarding
Prov
VA Master Person
Index (MPI)
HR SMART
VA Legacy PIV
TMS
EDR
MIM
Employee Data FeedEmployee Data Feed
PIV Data Feed PIV Data Feed
KEY
HL7 v3
LDAP
Non IAM
AcS
IdS
AD
Exchange Account ManagementAccount Management
VA Master Person
UI
Session Mgmt eCMS
Contract DataContract Data
Account Creation
TMS Training status notification
Account Creation
TMS Training status notification
AD ImportAD Import
Integration
Directory
(LDS)
AuthDB SSOi
Internally-Facing
VA Applications
STS
Authentication TraitsAuthentication Traits
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
Manage Person Identity
Onboard Person (UI for each Person Type)
Person Relationship Management
Identity Data Quality Resolution
LastAccess
Provision/Modify/Deprovision
Account/Access
Provision/Modify/Deprovision
Account/Access
VA-CABS Background investigationBackground investigation
USAccess PIV PIV Data Feed PIV Data Feed
V4.9 06/22/2023
Provisioning UI
USAStaffing Employee OnbaordingEmployee Onbaording
FHIR
Group ManagementGroup Management
Add/Update/Remove traits
Provision/Modify/Deprovision
V0.1 – Original Draft
V0.2 – Updates based on Peer Review
V0.3 – Updates based on Tech Review
V0.4 – Final Version for i3 Release
V1.0 – Draft updates based on i4 scope changes; reflects i3 Prod Deployment
V1.1 – Updates based on Tech Review
V1.2 – Removed i3; Updated i4 to reflect Prod Deployment; Updated AcS i2 to reflect F2F discussions; Added AcS i3
V2.0 – Removed i4; renamed increments appropriately (AcS 2.0 i2, AcS 2.0 i3); removed functionality from AcS 2.0 i2 that will not be delivered; changed SSOi attribute source to VDS; added PEP to VA internal applications; added SSOe to SSOi SAML connection
V2.1 – Removed AcS 2.0 i2 and added AcS 2.0 i4; updated based on actual i3 implementation and approved RSD for i4
V2.2 – Updated after IAM Tech Review.
V2.3 – Removed AcS 2.0 i3 and added AcS 2.0 i5
V2.4 – Updated for actual i5 deployment
V2.5 – Removed i4 and updates for i6; added AMS
V2.6 – Removed i5, updates for actual i6 deployment and added i7.
V2.7 – Update AcS 2.0 i7 – Prov based on ICAM F2F; added phased implementation for ICAM Onboarding
V2.8 – Updated based on changes to AMS implementation (data storage in MVI and staff UI in TK); PIV issuance interface to MVI
V2.9 – Updated for VIP1 and VIP2
V2.10 – Updated for VIP3 including: Migration of functionality from CA IdM to MVI, addition of ID.me as SSOe CSP
V3.0 – Updated to reflect VIP4 as well as migration away completely away from CA IdM
V4.0 – Renamed to as IAM Architecture; updated to reflect VIP5 (including sunset of VDS and CA IdM); moved Prov to be shown as IdS
V4.1 – Minor updates for VIP6; adding STS direct to AuthDB; removed extra tabs to now only show current VIP architecture
V4.2 – Minor updates for VIP7 and VIP8; additions to Prov integrations, removal of Norton Symantec CSP and addition of MHV CSP
V4.3 – Updates for VIP9; clearer definition of Prov and Master Person Uis
V4.4 – Minor updates for consistency
V4.5 – Update to add Login.gov
V4.6 – Update to remove SAC (service decommissioned)
V4.7 – Update to remove VA CSP (service decommissioned)
V4.8 – Update to add LastAccess
V4.9 – Updated Login.gov and ID.me from SAML to OIDC
V5.0 – Decommission eSig
Change History
| IAM Conceptual Architecture.vsd |
| Overall |
| External |
| Internal |
| Prov_Onboarding |
| Change History |
File details come from the government source that posted it. Updated .