Applicable Doc. 5A - IAM Playbook - Home.pdf

Last modified at 10/18/2023 1:27 PM by DeAntonio, Damien M. (Green Threads) (he/him/his)

The IAM Playbook Wiki is a work in progress to provide technical information to teams integrating with IAM Services and allow for rapid addition of content to make integrating easier. The pages for each service covered the integration patterns, integration gudiance, recommended architectures and links to any additional documentation.

Playbooks by Service The VA IAM services encapsulates people, processes, and technology to identify and manage the data used in an information system to authenticate users and grant or deny access rights to data and applications. The IAM services are grouped according to the Federal Identity, Credential, and Access Management (FICAM) business processes identified in the following table.

FICAM

Business Processes

VA IAM Solution Description

Identity Management

VA MPI - Master Person Index

Prov - Provisioning

Identity Management provides a process to vet users and manage the lifecycle of digital identities providing VA applications with a level of assurance that users are who they claim to be.

Credential Management

VHIC - Veteran Health Identification Card

Credential Management provides proof of identity for users that enable them to be uniquely distinguished by VA applications.

Access Management

SSOi - Single Sign- On Internal

SSOe - Single Sign- On External

Prov - Provisioning

AMS -

Authorization Management Service

Access Management provides capabilities that support authentication of users and authorization of user access enabling VA applications to safeguard information resources.

Auditing and Reporting

CAR - Compliance Audit and Reporting

Auditing and Reporting provides an enterprise reporting and auditing capability in a centralized fashion allowing VA to achieve transparency across a wider array of resources, detect and resolve inappropriate access, rapidly detect patterns of unauthorized access attempts, and support investigation of incident reports.

Additional information about FICAM can be found on the GSA maintained FICAM Architecture playbook. The IAM Architecture page provides some high-level architecture diagrams of the IAM services.

Page Rating

Categories No categories were selected https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/_layouts/listform.aspx?PageType=4&ListId={FC3D90CA-C60C-44F7-9901-1C022384F074}&ID=39 https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/VAMPI/VAMPI.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Prov/Prov.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/VHIC/VHIC.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOe/SSOe.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Prov/Prov.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/AMS/AMS.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/CAR/CAR.aspx https://arch.idmanagement.gov/ https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Architecture.aspx javascript:;

javascript:;

javascript:;

javascript:;

javascript:;

The IAM program is broken logically into Identity Services (IdS) and Access Services (AcS) with the services aligned as follows:

Identity Services (IdS)

VHIC

VA MPI, includes subcomponents

Person Service Identity Management (PSIM) Identity Management (IdM) Toolkit (TK) Master Data Management (MDM)

Provisioning Access Services (AcS)

SSOe AccessVA (SSOe’s public facing portal)

SSOi

AMS

CAR

IAM Environments URLs and Service Endpoints for all IAM services can be found HERE. Please keep in mind that service URLs typically will not work until your application has authorized to use the service, in order to get started an approved Service Request (SR) is required.

IAM also has an executive dashboard the provides information on service availability, reporting and more. The dashboard is available at https://iamportal.iam.va.gov/iamv2/index.php .

Issues?

For production issues, please submit a ticket via ServiceNow (https://yourit.va.gov/).

For non-production issues, please enter a Lower Environment Trouble Ticket (LETT) and someone from IAM O&M will work to resolve the issue (please note LETT response �me is within 24 hours). If you haven't used LETT before, see LETT instrcu�ons.

Specialized Playbook Pages PIV Compliance - information for applications working to become PIV compliant IAM Certificate Guidance - guidance on IAM certificate update process for partner applications Test VistA Information - information on testing VistA integrated applications with IAM SSOi Developer Self-Service - information on new self-service functionality that allows application developers the ability to implement and test configurations with IAM SSOi in the integrated development environment without IAM team involvement

[1] Within the FICAM Roadmap and Implementation Plan, electronic signature is considered a cryptography service. For the VA, electronic signature plays a critical role in https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/VHIC/VHIC.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/VAMPI/VAMPI.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Prov/Prov.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOe/SSOe.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/AMS/AMS.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/CAR/CAR.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20URLs.aspx https://dvagov.sharepoint.com/sites/CMDM-RP/SitePages/What-is-ITRP-.aspx https://iamportal.iam.va.gov/iamv2/index.php https://yourit.va.gov/ https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/LETT.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/PIV%20Compliance/PIV%20Compliance.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Certificates/IAM%20Certificate%20Guidance.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/piv%20compliance/vista/Integrated%20Web%20Application%20Test%20Information.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/ssoi/SSOi%20Developer%20Self-Service.aspx authenticating users and documentation as part of VA business processes. As such, the VA considers electronic signature to be an access management service.