Applicable Doc. 09 - IAM Requirements Backlog.pdf

Component/sBusiness Office (IAM)Issue key Summary Description

SSOi AIM ACSVC-1000 NPE with No User

STS shall be enhanced to provide a standard set of SSO authentication traits for the "NPE with No User" token type.

See STS SAML Token Definition.

SSOi AIM ACSVC-1001 NPE with No User For Entity type "NPE with No User", OAuth shall support the data

SSOi AIM ACSVC-1002 NPE with No User

OAuth shall be enhanced to accept a standard set of input parameters based on the "NPE with No User" entity token type and be capable of

SSOi AIM ACSVC-1003 NPE with No User

OAuth shall be enhanced to receive "NPE with No User" token type and be capable of offering the value within Introspect response.

SSOi AIM ACSVC-1004 NPE with Non-Enterprise User

For Entity type "NPE with Non-Enterprise User", STS shall support the data mapping for the STS Token Traits as identified in the STS SAML

Token Definition.

Note: STS shall retrieve System Metadata from a Provisioning

SSOi AIM ACSVC-1005 NPE with Non-Enterprise User

STS shall provide the capability to accept a standard set of input parameters based on the "NPE with Non-Enterprise User" entity token type as identified in the STS SAML Token Definition.

SSOi AIM ACSVC-1006 NPE with Non-Enterprise User

STS shall be enhanced to provide a standard set of SSO authentication traits for the "NPE with Non-Enterprise User" token type.

See STS SAML Token Definition.

SSOi AIM ACSVC-1007 NPE with Non-Enterprise User

For Entity type " NPE with Non-Enterprise User ", OAuth shall support the data mapping for the id_token.

SSOi AIM ACSVC-1008 NPE with Non-Enterprise User

OAuth shall be enhanced to accept a standard set of input parameters based on the " NPE with Non-Enterprise User " entity token type and

SSOi AIM ACSVC-1009 NPE with Non-Enterprise User

OAuth shall be enhanced to receive " NPE with Non-Enterprise User " token type and be capable of offering the value within Introspect

SSOi AIM ACSVC-1010 STS Support of NPE - Data Mapping

For Entity type "NPE with Enterprise Identity (Ent ID) only", STS shall support the data mapping for the STS Token Traits as identified in the

STS SAML Token Definition.

Note: STS shall retrieve System Metadata from a Provisioning

SSOi AIM ACSVC-1011

STS Support of NPE - IAM Standard

STS Token Input Parameters

STS shall provide the capability to accept a standard set of input parameters based on the "NPE with Enterprise Identity (Ent ID) only" entity token type as identified in the STS SAML Token Definition.

See STS SAML Token Definition.

SSOi AIM ACSVC-1012

Support of NPE - Non Person Entity

(NPE) Token Types

STS shall be enhanced to provide a standard set of SSO authentication traits for the "NPE with Enterprise Identity (Ent ID) only" token type.

See STS SAML Token Definition.

SSOi AIM ACSVC-1013

Support of NPE - Non Person Entity

(NPE) Token Types

For Entity type " NPE with Enterprise Identity (Ent ID) only ", OAuth shall support the data mapping for the id_token.

SSOi AIM ACSVC-1014

Support of NPE - Non Person Entity

(NPE) Token Types

OAuth shall be enhanced to accept a standard set of input parameters based on the "NPE with Enterprise Identity (Ent ID) only" entity token type and be capable of offering the value within id_token.

SSOi AIM ACSVC-1015

Support of NPE - Non Person Entity

(NPE) Token Types

OAuth shall be enhanced to receive "NPE with Enterprise Identity (Ent

ID) only" token type and be capable of offering the value within

SSOe Other ACSVC-1028

VHIC Self-Service Application -

Replacement Card

VHIC-SS shall, after “Replace Card― request from user, display replacement reasons and eligible mailing address to the user.

o VHIC-SS shall require the user to select a mailing address

Note: User can only select an eligible mailing address provided by VHIC services. User cannot update or add a mailing address at this screen.

ISAR AIM ACSVC-1301 ISAR - Transition to NIST 800-63-3 ISAR assurance level shall be updated to support for IAL and AAL.

SSOe AIM ACSVC-1302 SSOe Last Access - Transition to SSOe Last Access assurance level shall be updated to support IAL and

SSOe AIM ACSVC-1313

SSOe - Transition to NIST 800-63-3

IAL and AAL

SSOe shall enhance the DSLogon policies and mapper to support the transition from NIST 800-63-2 LOA to NIST 800-63-3 IAL and AAL.

a. SSOe shall move to full IAL and AAL for SSOe authentication policies.

b. SSOe shall move to full IAL and AAL for SSOe registration request policies.

SSOe AIM ACSVC-1314

SSOe - Transition to NIST 800-63-3

IAL and AAL

SSOe shall enhance the MHV IDP policies and mapper to support the transition from NIST 800-63-2 LOA to NIST 800-63-3 IAL and AAL.

* SSOe shall move to full IAL and AAL for SSOe authentication policies

* SSOe shall move to full IAL and AAL for SSOe registration request policies.

SSOe AIM ACSVC-1317

SSOe - SAML Test Harness - Provide

Performance Script Supporting

SSOe SAML Test Harness Client Application (e.g. TestSP) shall provide performance script supporting Broker partner like login through the

SSOe AIM ACSVC-1318

SSOe - SAML Test Harness - Provide

Performance Script Supporting

SSOe SAML Test Harness Client Application (e.g. TestSP) shall provide performance script supporting DSLogon like login through the harness

SSOe AIM ACSVC-1321

SSOe - SAML Test Harness - Issue

Partner Style SAML AuthnRequest

SAML Test Harness CSP (e.g. MockCSP) shall be sized in preprod (perf), to perform broker testing at current production peak load + 20%

SSOe AIM ACSVC-1322

SSOe - SAML Test Harness - Issue

CSP Style SAML Artifacts

SAML Test Harness CSP (e.g. MockCSP) shall be sized in preprod (perf), to perform artifact testing at current production peak load + 20%

SSOe AIM ACSVC-1323

SSOe - SAML Test Harness - Issue

CSP Style SAML Assertions

SAML Test Harness CSP (e.g. MockCSP) shall be sized in preprod (perf), to perform POST testing at current production peak load + 20%

VDT AIM ACSVC-1325 Updates to Utilize the Enhanced AMS Service shall be updated to utilitize the new eSig SaaS

VDT AIM ACSVC-1338

Delegation - Email Issue Indicator to AMS Users

After an AMS Staff UI user takes an action that triggers an auto-generated email, the AMS Staff UI shall present the user with an indication if the attempt to send email encounters any immediate issues, such as an inability to connect with the email server or an error returned from the email server.

Previous Epic ID: 357183

VDT AIM ACSVC-1339

Delegation - Email Issue Indicator to AMS Users

After a Veteran Delegation Tool user takes an action that triggers an auto-generated email, the Veteran Delegation Tool shall present the user with an indication if the attempt to send email encounters any immediate issues, such as an inability to connect with the email server or an error returned from the email server.

Previous Epic ID: 357183

VDT AIM ACSVC-1340

Delegation - AMS Invitation Flow

Enhancements

Cancelled invitations shall be visible in the AMS Staff User Interface for

30 days after expiration.

Previous Epic ID: 357177

VDT AIM ACSVC-1341

Delegation - AMS Invitation Flow

Enhancements

Cancelled invitations shall be visible in the Veteran Delegation Tool for

30 days after expiration.

Previous Epic ID: 357177

VDT AIM ACSVC-1342

Delegation - AMS Invitation Flow

Enhancements

An invitation that has been created by a Personal Representative on behalf of a veteran in the Veteran Delegation Tool, and is in the Sent state can be cancelled by the following:

The Personal Representative who created the invitation

The Veteran on whose behalf the invitation was created

Previous Epic ID: 357177

VDT AIM ACSVC-1343

Delegation - AMS Staff User

Interface Enhancements

The AMS Staff User Interface shall make a clear distinction between

Authorizations granted by a veteran and those granted to a Veteran.

Previous Epic ID: 357173

Previous BUS ID: 767535

VDT AIM ACSVC-1344

Delegation - AMS Staff User

Interface Enhancements

The AMS Staff User Interface shall make a clear distinction between

Authorization relationships and all other kinds of relationships.

Previous Epic ID: 357173

Previous BUS ID: 767534

VDT AIM ACSVC-1345

Delegation - AMS Staff User

Interface Enhancements

The AMS Staff User Interface shall prevent a user from creating an authorization that grants another person access to data about themselves.

Previous Epic ID: 357173

VDT AIM ACSVC-1346

Delegation - AMS Staff User

Interface Enhancements

The AMS Staff User Interface shall prevent a user from creating an authorization that grants themselves access to another person's data.

Previous Epic ID: 357173

Previous BUS ID: 767532

VDT AIM ACSVC-1347

Delegation - Veteran Delegation

Tool Enhancements

The Veteran Delegation Tool shall replace the accordion folder flow for guiding users through tasks such as granting an authorization with a wizard.

Previous Epic ID: 357170

VDT AIM ACSVC-1348

Delegation Staff-Facing User

Interface

The Delegation staff interface shall prevent a staff user from using the staff interface to create or edit any authorization that grants themselves access to another person's data.

Previous Epic ID: 265509

VDT AIM ACSVC-1349

IAM Delegation Staff-Facing User

Interface

The Delegation staff interface shall prevent a staff user from using the staff interface to access their own Delegation data.

Previous Epic ID: 265509

Previous BUS ID: 650418

VDT AIM ACSVC-1350

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to generate an invitation for a person to act as the Delegate for the

Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1351

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to electronically sign an in-progress VA Healthcare Proxy revocation for the Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1352

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to view and update an in-progress VA Healthcare Proxy revocation for the

Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1353

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to initiate a revocation of an existing VA Healthcare Proxy authorization for the

Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1354

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to electronically sign an in-progress VA Healthcare Proxy authorization for the Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1355

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to view and update an in-progress VA Healthcare Proxy authorization for the

Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1356

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall allow a user who has an active Personal Representative delegation to initiate a

VA Healthcare Proxy authorization for the Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1357

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall provide a user who has an active Personal Representative delegation the same view and update capabilities for the Delegation data of the Veteran for whom the user is a Personal Representative that the Veteran themselves would have.

Previous Epic ID: 265507

VDT AIM ACSVC-1358

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall provide a user who has an active Personal Representative delegation navigation capabilities to allow the user to view Delegation data the Veteran for whom the user is a Personal Representative:

Navigation to view the data of the person for whom the user is a

Personal Representative

A consistent visual indication that the user is viewing another person's date

Navigation out of the data of the Veteran for whom the user is a

VDT AIM ACSVC-1359

IAM Delegation Self-Service User

Interface

The IAM Delegation System shall perform an authorization check against the SAC Policy Decision Point (PDP) at the time the user navigates to see Delegation data of the Veteran for whom the user is a

Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1360

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall display a link to allow a user who has an active Personal Representative delegation to navigate to see the Delegation data of the Veteran for whom the user is a Personal Representative.

Previous Epic ID: 265507

VDT AIM ACSVC-1361

IAM Delegation Self-Service User

Interface

The IAM Delegation System self-service user interface shall check IAM

Delegation to see if the user has an active Personal Representative delegation.

Previous Epic WI ID: 265507

VDT AIM ACSVC-1362

IAM Delegation Self-Service User

Interface

The IAM self-service user interface shall support removal of the existing trait search functionality to identify a person in MVI to act as delegate.

Previous Epic WI ID: 265507

VDT AIM ACSVC-1363 Invitation to Act as Delegate Flow

The IAM Delegation System shall support the existing flow to fill out, sign and complete an authorization after initiation based on user selection of a person who has an existing relationship with the

Veteran.

Previous Epic WI ID: 265501

VDT AIM ACSVC-1364 VDT Service Security Enhancement

The VDT Application shall be enhanced to use the eSig gateway interface requiring use of SSOe STS token.

Previous Epic WI ID: 265514

Previous BUS IDs: 650434

SSOe Other ACSVC-1766 Technical Debt - Upgrade jQuery Upgrade jQuery to version 3.5.x for Technical Reference Model (TRM)

SSOi AIM ACSVC-2342

SSOi Shall Accept Updates from

ISAR

SSOi shall provide a capability to process ISAR configuration updates.

This shall include

  - SSOi: Provide read capability of SSOi Siteminder configuration in each SSOi environment.

SSOi AIM ACSVC-2345

SSOi Central Login Shall Accept

Updates from ISAR

Provide additional ISAR capabilities. This shall include:

  - SSOi: refactoring database to support each of: e.g. SSOi App config file, Central Login - Login FriendlyName, Central Login - Logout

FriendlyName

  - SSOe: extend SSOe read capabilities with a link with ISAM and expose ISAM content in the ISAR SSOe REST interface

CAR Other ACSVC-2552

ITRP SR 143 - BTSSS to CAR

Integration h3. IAM CAR Service shall provide a BTSSS Weekly Authentication by

Credential

Â

|*Report Name*|BTSSS Weekly Authentication by Credential Report|

|*IAM Service*|SSOe/AccessVA|

|*Description*|A weekly report providing daily counts and totals of

Beneficiary Travel Self-Serve System (BTSSS) credential authentications by CSP.

·     Date

§ DS Logon

§ MHV

§ VA PIV

§ ID.me

·     Totals by CSP|

|*Report Type*

*(Standard, Ad-Hoc, Custom)*|Custom|

|*Frequency (Schedule)*|Weekly (Sent on Mondays)|

|*Report Output File Type*|.csv|

CAR Other ACSVC-2553

ITRP SR 143 - BTSSS to CAR

Integration h3. IAM CAR Service shall provide a BTSSS Monthly Authentication by

Credential Report

|*Report Name*|BTSSS Montly Authentication by Credential Report|

|*IAM Service*|SSOe/AccessVA|

|*Description*|A monthly report providing weekly counts and totals of Beneficiary Travel Self-Serve System (BTSSS) credential authentications by CSP.

·     Date

§ DS Logon

§ MHV

§ VA PIV

§ ID.me

·     Totals by CSP|

|*Report Type*

*(Standard, Ad-Hoc, Custom)*|Custom|

|*Frequency (Schedule)*|Monthly (Sent on first day of month)|

|*Report Output File Type*|.csv|

CAR Other ACSVC-2554

ITRP SR 243 - BTSSS to CAR

Integration h3. IAM CAR Service shall provide a BTSSS Quarterly Authentication by

Credential Report

|*Report Name*|BTSSS Quarterly Authentication by Credential

Report|

|*IAM Service*|SSOe/AccessVA|

|*Description*|A quarterly report providing weekly counts and totals of Beneficiary Travel Self-Serve System (BTSSS) credential authentications by CSP.

·     Date

§ DS Logon

§ MHV

§ VA PIV

§ ID.me

·     Totals by CSP

Â

·     Totals by CSP for previous quarters|

|*Report Type*

*(Standard, Ad-Hoc, Custom)*|Custom|

|*Frequency (Schedule)*|Quarterly (Sent on first day of the next

SSOe AIM ACSVC-2629

Detailed Report Requirements -

ID.me Authentications: Initial

License Billing Event

|*Report Name*|ID.me Authentications:Â Initial License Billing Event|

|*IAM Service*|SSOe/AccessVA|

|*Description*|Report provides count of ID.me credentials that trigger an “initial licensing― billing event during selected reporting time-period.|

|*Authentication Characteristics*|1.      LOA3 ID.me authentications where a new _Initial License_ was acquired that triggered a billing event for the VA. Â

2.      IAL2 ID.me authentications where a new _Initial

License_ was acquired that triggered a billing event for the VA. |

|*Metrics to Capture/Calculations*|·        Count of LOA3

_Initial Licenses_ acquired within the reporting time frame

·        Count of IAL2 _Initial Licenses_ acquired within the reporting time frame|

|*Calculations*|Count of each ID.me authorizations|

|*Report Type*

*(Standard, Ad-Hoc, Custom)*|§ Custom|

|*Frequency (Schedule)*|Ability to select from one of the following reporting periods:

§ Weekly

§ Monthly

§ Quarterly

§ Annually|

SSOe AIM ACSVC-2630

Add Logging Support for New

ID.me License-Type Attributes

|*Report Name*|ID.me Authentications: Renewal License Billing

Event|

|*IAM Service*|SSOe/AccessVA|

|*Description*|Report provides count of ID.me credentials that trigger an “initial licensing― billing event during selected reporting time-period.|

|*Authentication Characteristics*|1.      LOA3 ID.me authentications where a new _Renewal License_ was acquired that triggered a billing event for the VA.Â

2.      IAL2 ID.me authentications where a new _Renewal

Licenses_ was acquired that triggered a billing event for the VA. |

|*Metrics to Capture/Calculations*|·        Count of LOA3

_Renewal Licenses_ acquired within the reporting time frame

·        Count of IAL2 _Renewal Licenses_ acquired within the reporting time frame|

|*Calculations*|Count of each ID.me authorizations|

|*Report Type*

*(Standard, Ad-Hoc, Custom)*|§ Custom|

|*Frequency (Schedule)*|Ability to select from one of the following reporting periods:

§ Weekly

§ Monthly

§ Quarterly eSig AIM ACSVC-2978 Upgrade DocuSign Java Client SDK Upgrade DocuSign Java Client SDK to the latest version (3.x).

SSOi AIM ACSVC-3094

No SSOi SAML without SecID and

ICN

Before generating a SAML assertion SSOi shall throw a friendly error message if nameID=SecID and SecID is null. The user-friendly error message shall be “There is an issue with your account, please open

SSOi AIM ACSVC-3206

Technical Debt - Windows Server

2016 and IIS 8.5

SSOi SiteMinder shall be updated to the latest version (12.8.06 or later) prior to End of Life of the current production deployed release.

SSOi AIM ACSVC-3465

SSOi SiteMinder shall accept updates from ISAR

SSOi SiteMinder shall provide a capability to process ISAR configuration updates. This shall include

* Processing and update of SSOi SiteMinder configuration in each

SSOe Other ACSVC-3542 SSOe Login.gov Update

Login.gov rollout to all of SSOe.

- Update Matrix

- Create ACLs for reassertion partners

- Work with partners on testing

SSOi AIM ACSVC-3561

SSOi database updates to support

ISAR configurations

SSOi shall update the SSOi database in support of ISAR configurations.

The SSOi database shall store

* SSOi App config file

* Central Login - Login Friendly Name

* Central Login - Logout Friendly Name

SSOi AIM ACSVC-3562

SSOi shall provide Central Login

Page data to ISAR

SSOI shall provide Central Login Page data to ISAR This shall include:

* expose the Central Login Page configuration in each SSOi

SSOi AIM ACSVC-3563

SSOi shall provide Application Page data to ISAR

SSOI shall provide Application Page data to ISAR This shall include:

* expose the Application Page configuration in each SSOi environment

SSOe AIM ACSVC-3838

Terminating User's Session from

ID.me

SSOe shall add support for terminating the user’s session from

ID.me during SSOe global logout to ensure that in addition to the SSOe session and application sessions, the IdP session is also terminated.

VHIC-SS AIM ACSVC-4271

VHIC Card Self Service –

Preferred Name (front end)

The VHIC will enhance the Self-Service Application to include support for the Veteran’s Preferred Name.

* The VHIC-SS shall display the Veteran’s Preferred Name in addition to the Veteran’s Legal Name when the Veteran’s Legal

Name is displayed throughout the system.

* The Veteran’s Preferred Name shall be displayed on the face of

SSOi AIM ACSVC-4361

SSOi Portal site performance redesign and enhancements

The SSOi Portal page has continued to fail performance testing with the current Angular and Apache/WebAgent Tomcat design.

Recommendation is to re-design the site to be more performant and cloud app services aware with a full DEVSECOPS life-cycle that can be used to support further re-architecture of IAM services. Utilizing webAgent container design would also give us the opportunity to

SSOi AIM ACSVC-4362

SSOi performance test enhancement for AuthZ load

SSOi shall provide the configuration or design enhancement for SSOi performance testing with load on the authorization side.

SSOe Other ACSVC-4558

SSOe - Update the IAM Header

Page and Indicator on Non-

Recommended Headers

Validate headers that are usable by partners vs. diagnostics.

Ensure all headers as defined on the playbook are available on all junctions. csp_mapper is one that's been questioned.

SSOe Other ACSVC-554

SSOe - enhancement to decouple reassertion saml links from partners for SSO

Basic idea would be to give a partner a link like

[https://eauth.va.gov/accessva/ssop?partner=csm] instead of one like

[https://eauth.va.gov/isam/sps/saml20idp/saml20/logininitial?Partner

Id=https://vaoitprod.servicenowservices.com&Target=/csm]Â that tightly couple them to the federation data.

Use Case:Â As a SSOe Partner, I want to be able to use SSO links to other partners that do not require me to update the links when federation data changes.

SSOe Other ACSVC-5633

Enhance User Interface for

AccessVA

SSOe VA.gov like modal shall be provided in addition to the existing

AccessVA CSP selection page.

SSOe VA.gov like modal shall support Login.gov account *login* by IAL and AAL per partner context.

SSOe VA.gov like modal shall support ID.me account *login* by LOA, IAL and AAL per partner context.

SSOe VA.gov like modal shall support DSLogon account *login* by LOA per partner context.

SSOe VA.gov like modal shall support My HealtheVet account login by

LOA per partner context.

SSOe VA.gov like modal shall support PIV account *login* per partner context.

SSOe VA.gov like modal shall support CAC account *login* per partner context.

SSOe Other ACSVC-5955 SSOe Binding Application

IAM shall develop an SSOe binding application that allows a legacy credential (DS Logon or MHV) authenticated user to create/authenticate with an IAL1 modern credential (Login.gov or

ID.me) with the same session allowing for this IAL1 modern credential to be associated to their identity (via provided VA MPI API*).

* User shall be redirected to SSOe binding application by SSOe logic or application logic

* SSOe binding application shall provide three options 1) continue to application 2) create/authenticate with IAL1 modern credential 3) create/authenticate with IAL2 modern credential (this doesn’t

SSOi Other ACSVC-6030

AcS OAuth Refresh Data Validation

Update to Error Logic

AcS OAuth/OIDC system shall be enhanced to allow communication failures when processing the refresh data validation business logic to fail closed for SSOe (e.g., if data cannot be retrieved return error and force reauthentication) and fail open for SSOi (e.g., – if data cannot

SSOe Other ACSVC-6104

SSOe AccessVA and CSP Selection

Enhancement

SSOe AccessVA and CSP selection functionality shall be enhanced to have an additional option with a look and feel similar to VA.gov.

SSOe VA.gov like modal shall support Login.gov account creation by

IAL and AAL per partner modal.

SSOe VA.gov like modal shall support ID.me account creation by IAL

SSOe Other ACSVC-6105

SSOe AccessVA and CSP Selection

Enhancement

SSOe VA.gov like modal shall provide information and contacts for “trouble signing in― on a system context.

SSOe Other ACSVC-6106 SSOe AccessVA and CSP Selection SSOe VA.gov like modal shall support display of “Terms of use― on

SSOe Other ACSVC-6108 SSOe Binding Application

SSOe mapper shall be updated to support the legacy credential binding process

* SSOe shall have a per application configurable option at time of authentication to redirect a qualified user to the SSOe Binding

Application

** A qualified user is defined as a user authenticating with a configured legacy credential at LOA2 and without a modern credential already associated to their identity.

*** Initially this will be implemented for DS Logon but in the future could be enabled for MHV credential

* SSOe shall be updated to call VA MPI getTraitsByCSPID for IAL1 modern credentials (currently VA MPI call is only made for LOA/IAL2+)

** If VA MPI returns identity data (IAL1 account that has been bound)

SSOe Other ACSVC-6146 SSOe Active-Active

The SSOe Service shall be enhanced to support to simultaneous user access in both VAEC Azure regions (VA & TX).

The SSOe Monitoring, Reporting, and Dashboards shall be enhanced to support SSOe Active-Active.

SSO Other ACSVC-6148

OAuth (SSOi and SSOe) Active-

Active

The IAM OAuth (SSOi and SSOe) shall be enhanced to support to simultaneous user access in both VAEC Azure regions (VA & TX).

The IAM OAuth (SSOi and SSOe) Monitoring, Reporting, and

Dashboards shall be enhanced to support SSOi Active-Active.

SSO Other ACSVC-6353

SSOi OAuth Access Token to STS signed JWT

STS shall be enhanced to provide the ability to exchange a SSOi OAuth access token for signed JWT token.

STS shall follow the trait standards set within separate STS SAML and

JWT Token Description V3.0 for SSOi OAuth access token for signed

SSOi Other ACSVC-6354

SSOi IAMSESSION to STS signed

JWT

STS shall be enhanced to provide the ability to exchange a SSOi

IAMSESSION for signed JWT token.

JWT Token Description V3.0 for SSOi IAMSESSION for signed JWT

SSOe Other ACSVC-6355 SSOe PDSESSION to STS signed JWT

STS shall be enhanced to provide the ability to exchange a SSOe

PDSESSION for signed JWT token.

JWT Token Description V3.0 for SSOe PDSESSION for signed JWT

SSOi Other ACSVC-6396

OAuth Self-Service Mobile/SPA pattern implementation for SSOi

Services

* OAuth Self-Service application shall only be implemented in the iDev environment.

* OAuth Self-Service Playbook page shall be updated to include details on how a partner enters the process, available features and capabilities, how to get support for the Mobile/SPA pattern.

* OAuth Self-Service Playbook page shall be updated to include details on the OAuth self-service process including examples of verification testing for the Mobile/SPA pattern.

* The minimum release of the OAuth Self-Service application for the

Mobile/SPA pattern shall support collection of data from partner

(relevant to pattern), validation of data where possible, and once uploaded a response with data and actions the partner will/can perform. Any errors or adjustments must be coordinated with appropriate SME.

* The minimum release of the OAuth Self-Service application shall support complete configuration of OAuth Mobile/SPA pattern per

Integration Agreement (IA) technical specifications (no custom options selected).

* OAuth Self-Service application for the Mobile/SPA pattern shall provide a workflow page to capture inputs for the self-service.

* OAuth Self-Service application for the Mobile/SPA pattern shall provide the capability for the user/developer to submit self-service workflow input data.

* OAuth Self-Service application for the Mobile/SPA pattern shall provide description of all data elements requested.

* OAuth Self-Service application for the Mobile/SPA pattern shall provide indication of all required elements requested.

* OAuth Self-Service application for the Mobile/SPA pattern shall evaluate/validate the self-service inputs.

SSOe Other ACSVC-6397

SSOe OAuth Access Token to STS signed JWT

STS shall be enhanced to provide the ability to exchange a SSOe OAuth access token for signed JWT token.

JWT Token Description V3.0 for SSOe OAuth access token for signed

SSOe Other ACSVC-6454 VA.gov to OIDC

VA.gov utilizes 20x more reassertions than any other partner at roughly 75% of all reassertion authorizations for SSOe. Â

* Legacy SAML Federations are not mobile friendly – The browser carries the SAML payload, and uses HTTP POST, HTTP retries fail.

* OIDC is a lighter protocol compared to Legacy SAML.

* gov currently uses SAML reassertions from SSOe to VA.gov

* Legacy SAML Federations are not mobile friendly – The browser carries the SAML payload, and uses HTTP POST, HTTP retries fail.

* Creates OIDC as a new integration pattern.

* Requires SLO is completed for OIDC.

SSOe Other ACSVC-6456

Implement SSO OAuth Provider on

SSOe

* Implement SSOi OIDC for Federation OAuth provider to EAuth.

* SSO OAuth (on Fed) require Legacy SAML Federations from SSOe &

SSOi are not mobile friendly – The browser carries the SAML payload, and uses HTTP POST, HTTP retries fail.

SSOe AIM ACSVC-6759 SSOe Mapper Name Logic Update

The SSOe Mapper Name Logic shall be updated to overwrite all SSOe name attributes, thus removing all received from the CSP, replacing with data from all the name attributes received from VA MPI. E.g., if

MPI name will be used, empty out the SSOe name objects prior to populating with MPI data. This includes first name, middle name, SSOe IAM ACSVC-7362

Convert Extended-ASCII Characters to a Standard ASCII Equivalent

SSOe shall implement mapping functionality to convert extended ASCII values to the ASCII 128 equivalent value for use across partner data

SSOi Other ACSVC-7434

SSOi Self-Service OAuth Scope

Configuration Fix

The Self-Service Tool shall be updated to support no scope entry in the ‘other information’ field if no scopes are configured in the Self-

Service tool. E.g., other information field to be kept empty when no

SSOe Other ACSVC-7437

Implement Encrypted Cookie for

Terms of Use

SSOe shall be enhanced to support moving to an encrypted cookie so only trusted partners (e.g. SuS and VA.gov T&C UI) would be able to

SSOi AIM ACSVC-998 NPE with No User

For Entity type "NPE with No User", STS shall support the data mapping for the STS Token Traits as identified in the STS SAML Token

Definition.

Note: STS shall retrieve System Metadata from a Provisioning

SSOi AIM ACSVC-999 NPE with No User

STS shall provide the capability to accept a standard set of input parameters based on the "NPE with No User" entity token type as identified in the STS SAML Token Definition.

PROV OEHRM VAMPI-10045 Deactivate a Cerner Role

The Provisioning Service shall allow a Cerner Administrator to deactivate a Cerner Role in the Cerner Utilities page of IAM

PROV OEHRM VAMPI-10046

The Provisioning service shall allow a Cerner Administrator to export all

The Provisioning service shall allow a Cerner Administrator to export all Cerner Roles and the information per application in the Cerner

PROV OEHRM VAMPI-10047 Import Roles and role information

The Provisioning Service shall allow a Cerner Administrator to import a file containing Roles and role information on a per application basis.

OBS EMP AIM VAMPI-10126

Update text Employee Dashboard

Tile

IAM Onboarding shall update the text displayed on the Employee

Dashboard tile to “Track the Onboarding Status of an Employee―

PROV IAM Technical VAMPI-10434 ISAR Read SSOi Configurations

ISAR shall provide a capability to read and display SSOi configurations.

This shall include

* Configuration of SSOi as an application in ISAR

* Retrieve and display of the current SSOi configurations

VA MPI IAM Technical VAMPI-10564

Enhance Search for Targeted

Person Categories

VA MPI shall be enhanced to provide enhanced search for targeted

Person Categories in the VA MPI TK.

The process would follow the normal search process in the MDM and then filter the results by Person Category.

VA MPI IAM Technical VAMPI-11161 Support Active – Active

VA MPI shall be enhance the reliability and performance by supporting

Active - Active system configuration.

TK Other VAMPI-11911 TK Property release - SQA

VA MPI HCIdM VAMPI-11946

Support Sharing Test Patient with

VA Profile and ES

VA MPI shall be enhanced to share Test Patient indicator with ES and

VA Profile.

Sharing Test Patient with ES will be done by adding an indicator in the

Primary View.

Sharing Test Patient with VA Profile will be done by directly setting the test Patient status in VA Profile.

VA MPI HCIdM VAMPI-11947 Retrieve Relationships from DoD

VA MPI shall create a service to retrieve relationships from DoD and display in the TK??

VA MPI IAM Technical VAMPI-11948

Enhance Storage and Display of

Relationship Types

VA MPI shall enhance the database to support quick extensibility for additional relationship types.

The current relationship types are hard coded and the goal will be to move it to a source list that would be updated as we continue to expand relationship.

In additional changes in the database are needed to support bi-directional relationship.

Example Father – Son and also Son – Father.

PROV OEHRM VAMPI-12378

Display an alert when the URAC tries to provision a user to roles in

Millennium

The Provisioning Service shall display an alert when the URAC tries to provision a user to roles (positions) in Millennium that require Identity

Affirmation without the appropriate PIV card. The users will need to be trackable and reportable by the URAC.

Note: Provisioning should not be prevented

PROV OEHRM VAMPI-12380

Display an alert when the URAC tries to provision a user to iAccess

The Provisioning Service shall display an alert when the URAC tries to provision a user to iAccess without the appropriate PIV card. The users will need to be trackable and reportable by the URAC.

Note: Provisioning should not be prevented.

PROV IAM Technical VAMPI-12388 ISAR provide Updates to SSOe ISAR shall extend SSOe Read Capability to include data from ISAM

PROV IAM Technical VAMPI-12389

ISAR Update SSOi SiteMinder

Configurations

ISAR shall provide a capability to update SSOi SiteMinder configurations. This shall include

* Pushing updated configurations to SSOi SiteMinder

PROV IAM Technical VAMPI-12390

ISAR Read SSOi Central Login Page

Configurations

ISAR shall provide a capability to read and display SSOi Central Login

Page configurations. This shall include

* Retrieve and display of the current SSOi Central Login page configurations

PROV IAM Technical VAMPI-12391

ISAR Update SSOi Central Login

Page Configurations

ISAR shall provide a capability to update SSOi Central Login Page configurations. This shall include

* Pushing updated configurations to SSOi Central Login Page

* Updating transaction records in ISAR

PROV IAM Technical VAMPI-12392

ISAR Read SSOi Application Page

Configurations

ISAR shall provide a capability to read and display SSOi Application

Page configurations. This shall include

* Retrieve and display of the current SSOi Application page configurations

PROV IAM Technical VAMPI-12393

ISAR Update SSOi Application Page

Configurations

ISAR shall provide a capability to update SSOi Application Page configurations. This shall include

* Pushing updated configurations to SSOi Application Page

PROV AIM VAMPI-12594

Align Delegation Staff UI document scanning with VAMC document scanning

Currently, the IdM Toolkit Delegation module requires Delegation

Administrations to scan a completed paper VA Healthcare Proxy form

10-10147b 10-10147a then upload the file into the IdM Toolkit when assisting Veterans face to face with setting up Delegates.

Issue 1:  According to VHA Privacy and Access, completed VA authorizations forms must reside in the patient's electronic health record so it can be accessible to ROI staff, healthcare team and others that need to know review the authorizations.

Issue 2: VA staff does not have access to scanning equipment in their office. According to ROI the common practice at VAMCs is to send all completed VA forms to the scanning unit at their VA who will scan forms into a patient's medical record VistA imaging module. The scanning unit at some VAs are experiencing a delay so the time it takes for the forms to be scan varies across all VAs. In addition, some

VAMCs have locked down the hard drives where saving files on their local computer with PII is not permitted.ÂÂ

This request is to remove the requirement for VA staff to scan the forms and upload them into the IdM Toolkit Delegation

OBS EMP AIM VAMPI-12595

Maintain user data during

Employee Transfer

The transfer request for a VA Employee shall maintain the accounts associated with the VA Employee profile and disseminate attribute changes as required (refer to Appendix G Attribute Data Map).

PROV AIM VAMPI-12610

Provide the capability for SSOe to support CSP authentication and

Provide the capability for SSOe to support CSP authentication and registration request policies for NIST 800-63-3 Identity Assurance Level

PROV AIM VAMPI-12611 AIM PMO IGA BRD - FR092

The IGA Solution shall provide out-of-the-box reports to track policy violation activities such as revoked access.

PROV AIM VAMPI-12612 AIM PMO IGA BRD - FR083

The IGA Solution shall have the ability to provide access certification reporting as part of each certification event.

PROV AIM VAMPI-12613 AIM PMO IGA BRD - FR082 The IGA Solution shall have the ability to provide orphan account

PROV AIM VAMPI-12614 AIM PMO IGA BRD - FR081

The IGA Solution shall have the capability for full control and accountability over privileged users on in-scope systems.

PROV AIM VAMPI-12615 AIM PMO IGA BRD - FR079

The IGA Solution in integration with VA’s PAM tool shall have the ability to flag unused or orphan privileged accounts to reduce

PROV AIM VAMPI-12616 AIM PMO IGA BRD - FR076

The IGA Solution shall have the ability to create risk-based approval workflows for privileged user / service accounts during the access

PROV AIM VAMPI-12617 AIM PMO IGA BRD - FR073

The IGA Solution shall have the ability to send escalation email notifications in configurable timelines in case the certifier does not act

PROV AIM VAMPI-12618 AIM PMO IGA BRD - FR072

The IGA Solution shall have the ability to send reminder email notifications in configurable timelines in case the certifier does not

PROV AIM VAMPI-12619 AIM PMO IGA BRD - FR071

The IGA Solution shall have the ability to provide an access review dashboard for compliance officer / auditor to oversee access

PROV AIM VAMPI-12620 AIM PMO IGA BRD - FR070 The IGA Solution Administrator shall have the ability to launch on-

PROV AIM VAMPI-12621 AIM PMO IGA BRD - FR069

The IGA Solution Administrator shall have the ability to launch event-driven access certification for specific users when certain criteria are met (user moved from employee to contractor or vice-versa).

PROV AIM VAMPI-12622 AIM PMO IGA BRD - FR068

The IGA Solution shall have the ability for the certifier to delegate the access certification to a different user if the original certifier is unable

PROV AIM VAMPI-12623 AIM PMO IGA BRD - FR067

The IGA Solution administrator shall have the ability to delegate the access certification to a different certifier (proxy) in case the original

PROV AIM VAMPI-12624 AIM PMO IGA BRD - FR066

The IGA Solution shall have the ability to reconcile access privilege / entitlement information for VA users through a scheduled process.

PROV AIM VAMPI-12625 AIM PMO IGA BRD - FR065

Upon completion of the access certification campaign, the IGA

Solution shall be able to provide closed-loop remediation for an automated, end-to-end location for reviewing and revoking access across target systems and business applications, which automatically

PROV AIM VAMPI-12626 AIM PMO IGA BRD - FR064

Upon completion of the access certification campaign, the IGA

Solution shall have the ability to send a report containing revoked access list to the security compliance team to ensure access

PROV AIM VAMPI-12627 AIM PMO IGA BRD - FR063

The IGA Solution shall provide the ability to the designated user to certify / revoke entitlements for workers who report directly to him /

PROV AIM VAMPI-12628 AIM PMO IGA BRD - FR062

The IGA Solution shall have the ability for the designated role owner to log into the solution to view the open access certification and drill down to details on their particular role and the access it entails along

PROV AIM VAMPI-12629 AIM PMO IGA BRD - FR061

The IGA Solution shall have the ability for the designated application owner to log into the solution to view the open access certification and drill down to details on their application along with a listing of

PROV AIM VAMPI-12630 AIM PMO IGA BRD - FR060

The IGA Solution shall have the ability for the designated user to log into the solution to view the open access certification and drill down to details on workers reporting to him / her along with information on

PROV AIM VAMPI-12631 AIM PMO IGA BRD - FR059

The IGA Solution shall have the ability to notify managers / supervisors

/ application owners / role owners of a new access certification

PROV AIM VAMPI-12632 AIM PMO IGA BRD - FR058

The IGA Solution shall have the ability to dynamically populate the certifier email addresses by virtue of leveraging the organizational

PROV AIM VAMPI-12633 AIM PMO IGA BRD - FR057

The IGA Solution shall have the ability to customize the access certification email templates, duration of the campaign, certification

PROV AIM VAMPI-12634 AIM PMO IGA BRD - FR056

The IGA Solution shall have the ability to launch automated and scheduled periodic access certification campaigns.

PROV AIM VAMPI-12635 AIM PMO IGA BRD - FR055

The IGA Solution shall have the ability to launch access certification campaigns for users under the VA organization.

PROV AIM VAMPI-12636 AIM PMO IGA BRD - FR054

The IGA Solution shall have the ability for the requestor to be able to view the Risk Score for the user and the requested access and shall be

PROV AIM VAMPI-12637 AIM PMO IGA BRD - FR053 IGA Solution shall have the ability to assign risk scores to applications /

PROV AIM VAMPI-12638 AIM PMO IGA BRD - FR036

The IGA Solution shall provide the ability to support the creation of a

SOD matrix to prevent toxic combination of access.

PROV AIM VAMPI-12639 AIM PMO IGA BRD - FR034

The IGA Solution shall have advanced analytics capabilities that showcase patterns of users in entitlements, role similarity comparisons, IT Audit violations within role definitions, percentage of

PROV AIM VAMPI-12640 AIM PMO IGA BRD - FR032

The IGA Solution shall have the ability to send an escalation notification in case the role owner has not acted on the role update

PROV AIM VAMPI-12641 AIM PMO IGA BRD - FR031

The IGA Solution shall have the ability to send a notification to the role owner to approve / reject changes made to a role.

PROV AIM VAMPI-12642 AIM PMO IGA BRD - FR030

The IGA Solution shall provide the ability to assign role owners (to one unique identity or assign to a group of multiple identities) to a role.

PROV AIM VAMPI-12643 AIM PMO IGA BRD - FR029

The IGA Solution shall provide the ability through UI to manage role lifecycle management activities. These role lifecycle management activities include but are not limited to:

• Role metadata update

• Role content update

• Role versioning

PROV AIM VAMPI-12644 AIM PMO IGA BRD - FR028

The IGA Solution shall have the capability to perform automated role mining based on role engineering input parameters (for example, each time a new application is onboarded, additional department / cost

PROV AIM VAMPI-12645 AIM PMO IGA BRD - FR027

The IGA Solution shall provide the ability to create enterprise / organization / job roles and associated access policies.

OBS OFF AIM VAMPI-12646

OBS Offboard Notifications to

WebVRAM

When a user is being offboarded, Provisioning shall check for the presence of a WebVRAM account associated with the user.

# If a WebVRAM account is associated with the user, IAM shall send a deprovisioning message to WebVRAM.

OBS AFF AIM VAMPI-12648

Accredited Reps Onboarding.

Support the objective to centralize all user types within OBS by

Accredited Rep user type Onboarding Services:

*Current iRSD development

*Development of Accredited Rep functionalities and testing

PROV AIM VAMPI-12651

Implementation of non-person entity (NPE) (service to service)

Implementation of non-person entity (NPE) (service to service) enterprise authentication services

PROV AIM VAMPI-12652

Integration of Prov with Service

Oriented Architecture Research

Integration of Provisioning with Service Oriented Architecture

Research and Development (SOARD)/Maximo supporting provision of

PROV AIM VAMPI-12653 Integration of Provisioning with Integration of Provisioning with VBA Common Security Services

VA MPI HCIdM VAMPI-12678

Import Request by Type and

Subtype

VA MPI shall be enhanced to support importing Cerner/Millennium data cleanup identifier and trait Anomaly reports into work items in

HC IDM Toolkit

Note: The detailed technical solution is pending the IAM Design

VA MPI VEO VAMPI-12680

Upgrade to MVI matching algorithm for VBA user population

Upgrade to MVI matching algorithm for VBA user population: Update to the latest version of the matching algorithm from IBM that MPI uses to maintain industry standard level of identity management.

Research the technical feasibility and benefit of adding additional data elements (such as email and additional address types). These

VA MPI HCIdM VAMPI-12681

Additional MPI enhancements to support OEHRM shared patients

"Additional MPI enhancements to support OEHRM shared patients to provide consistent, accurate, up-to-date patient identity data across the two enterprise identity systems (VA MPI and DEERS) to support sharing across the entire spectrum of healthcare systems, which facilitates the provision of direct patient care, accurate patient matching, community sharing, longitudinal health record management and analytics.ÂÂ

As the VA and DoD business teams work through new or improved

VA MPI VEO VAMPI-12689 Support Record Sensitivity

Record Sensitivity: This functionality would provide identification of persons whose VA records (identity, contact information, and line of business data such as clinical and claim related information) need to be restricted within various business process. For FY20, the data analysis, planning, determination of the appropriate data domain and

VA MPI VEO VAMPI-12690 Add Specific Prompt in TK to Add specific input prompts in TK to support lookup by email (work and

VA MPI VEO VAMPI-12691 Support Family Relationship

Establishing and managing family and third-party relationships between identities stored in MPI will provide Veterans with the ability to provide relationship information to one VA LoB and ensure the information is shared with other business units, making it easier and less frustrating for veterans to do business with VA. A single solution also ensures the business units are not incurring unnecessary costs by building multiple solutions and having redundant stovepiped data stores for this critical information.

Implementation of enhanced relationship management capabilities

VA MPI HCIdM VAMPI-12700

Add Patient Pause Functionality to

Supporting Order of Processing

Identity Updates

MPI-VistA inpatient pause functionality is necessary to support the

Cerner Millennium pause of EDIPI merges when there is a specific type of encounter in an open status. These changes will support identity for OEHRM patients. The current MPI-VistA inpatient pause functionality will not meet the needs for EHRM patients.

The MPI and VistA functionality used today for inpatient pauses when an identity trait is paused at the facility where a patient is an inpatient may require enhancements as Cerner implements a pause

PROV OEHRM VAMPI-12775

Provide the capability for the URAC to upload a list of user EDIPIs

The Provisioning system shall provide the capability for the URAC to upload a list of user EDIPIs via"MyFiles/User Provisioning Upload" to

PROV OEHRM VAMPI-12776

Provide URAC training recommendations based on role

The Provisioning Service shall provide the URAC training recommendations for user based on roles assigned and user's current

PROV OEHRM VAMPI-12778

Retrieve and display Business

Credential Information

The Provisioning Service shall retrieve and display Business Credential

Information from authoritative sources within VA for purposes of

PROV OEHRM VAMPI-12780 Constrain the URAC's site display

The Provisioning Service shall constrain the URAC's site display, across the UI, to only those sites he/she is affiliated to - VA Station, top level

HealtheIntent Sites/VISNs, HealtheIntent/Org Member &

HealtheIntent/Org Admin drop downs and roles associated to sites Ex:

PROV OEHRM VAMPI-12781 Decomission Quick Provisioning on The Provisioining Service shall decomission Quick Provisioning on the

PROV OEHRM VAMPI-12782 Decomission Quick Provisioning for The Provsisioning Service shall decomission Quick Provisioning for Bulk

PROV OEHRM VAMPI-12783

The Provisioning Service shall create a way for the URAC to

The Provisioning Service shall create a way for the URAC to search for provisioning request based on Cerner ticket number (eService)

PROV OEHRM VAMPI-12785 URAC reconciliation email The Provisioning Service shall email URACs and users after

PROV OEHRM VAMPI-12786 Provisioning UI hover/help text

The Provisioning Service shall provide hover/help text to aid URACs to enter/select data in the provisoning UI - Ex: All fields in the "User

PROV OEHRM VAMPI-12788 Make all panels…