Applicable Doc. 5C - IAM Playbook - SSOi.pdf

Last modified at 9/5/2023 10:41 AM by Vessels, Perry L. (Argil Solutions)

IAM Playbook Home

SSOi Playbook This (and all IAM playbooks) playbook is a collaborative and continuously improved wiki/document. The purpose of the wiki/document is to provide as much useful technical information to integrating partners, if there is information that you feel is missing please let us know and we can add it or even give you contributor rights to add the information yourself!

Applications interested in using any of the IAM services should submit a service request (SR) using the Information Technology Request Portal (ITRP) to start the process.

References AcS Common Business Rules - provides details on SSOi business rules (see Section 2.2)

Login Failure and Timeouts Standard Authentication Trait Sets

Enterprise Design Patterns Single Sign-on Multi-factor authentication

Overview As defined in the FICAM Roadmap, authentication is the process of verifying that a claimed identity is genuine and based on valid credentials. It is once an individual’s identity is authenticated that access-related decisions may be made on both logical and physical resources. Before authentication may take place, individuals must first be issued a valid credential of the appropriate assurance level.

Redundant and incompatible authentication mechanisms, associated with individual applications, were previously prevalent across the VA landscape, resulting in a wide array of proprietary, single-use credentials and authentication protocols. However, the SSOi service now allows internal users access to a variety of VA systems and applications using a reduced set of login credentials, including VA-issued PIV cards (LOA 4) and credentials generated by the VA Active Directory (LOA 2). The following table lists the detailed functions offered by the SSOi service.

Function Description Supporting Interfaces

Authenticate Internal User

Allows a User to sign on once to an application, using PIV or AD username/password, then allows the User to access other integrated applications using the sign on credentials originally submitted

CA SiteMinder Web Agent CA SiteMinder SPS IdP to SP Federation

Manage User Session Provides a session management service for the SSO environment, which includes user identity data, idle, and max use timeouts

CA SiteMinder Web Agent CA SiteMinder SPS

Enforce Coarse-Grained Authorization

Provides enforcement of coarse-grained access control decisions and grants or denies access to information resources. Typical authorizations are based on Active Directory groups or information in Provisioning.

CA SiteMinder Web Agent CA SiteMinder SPS IdP to SP Federation

Issue STS Token Provides the ability to obtain an STS token representing the authenticated user SSOi STS

Perform Global Logoff Provides the ability for Users to log out from all the open SSOi Service-integrated applications

CA SiteMinder Web Agent CA SiteMinder SPS

From a user flow perspective, the following diagram depicts a high level top-down flow through the SSOi system.

Page Rating

Categories No categories were selected

IAM Playbooks

SSOi https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/_layouts/listform.aspx?PageType=4&ListId={FC3D90CA-C60C-44F7-9901-1C022384F074}&ID=29 https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx https://dvagov.sharepoint.com/sites/CMDM-RP/SitePages/What-is-ITRP-.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/AcS_Common_Business_Rules_Document.pdf https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-design-patterns/ javascript:;

javascript:;

javascript:;

javascript:;

javascript:;

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx

Phase 1 - App Navigation

User access usually begins with the user typing in the URL in their address bar, clicking on a bookmark, or using a shortcut previously created on their desktop. This step initiates the login process within SSOi for its partner applications and their associated integration pattern.

For more information, see the table of Integration Patterns below.

Phase 2 - Authentication

The authentication phase takes place on the Central Logon site (see Main Login page and Other Sign-in Options modal). This site accepts three methods of authentication:

1. PKI – used to allow users to authenticate with a VA PIV card, an enterprise approved Derived Credential, or a DoD CAC card.

2. Username and Password – designed to only accept the VA Active Directory password. The user must have a VA PIV Exemption and password access reestablished.

3. Active Directory Integrated Windows Authentication – allows the use of the Microsoft desktop credential as an authentication token

Phase 3 – Context Attribute Retrieval

After authentication, SSOi uses the authenticated identity that the credential provides to map the user to an enterprise record and obtain additional identity identifiers and other information. To do this, SSOi utilizes backend services from Active Directory, Provisioning and MVI. Also in this phase, additional run-time authentication data is generated for the user. All of this information is made available to partners.

For specific traits available see: SSOi Authentication Trait Sets.

Phase 4 - Session Management

Once a user has been moved into session management, that user is available for use within the various Integration Patterns. Session management holds the run-time login authentication traits for the authenticated user while the session is active and other traits are pulled from backend systems when needed. The session management layer also enforces VA 6500 and NIST 800-53 Session Management security controls for Session Timeout (AC-11: Session Lock) and Logout (AC-12: Session Termination) which are inherited controls for partner applications (except partners implementing the IdP-to-SP (SAML) Federation or the OAuth/OIDC patterns.

SSOi maximum idle time is 60 minutes. Activity is measure by network connections being made from the client to the server.

SSOi maximum session time is 10 hours. This means a user is permitted to be active in an application for 10-hours before the system forces a re-authentication.

Phase 5 – SSO Access

The SSO Access phase is realized through the use of the Integration Patterns describe in the next section.

Integration Patterns Based on the existing application architecture, there are different integration patterns for leveraging the SSOi service.

Pattern What does it do?

CA

SiteMinder https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/SSOi/Central%20Login%20Main%20Page.png https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/SSOi/Central%20Login%20Modal%20IWA%20and%20VA%20Network%20ID.png https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20Authentication%20Trait%20Sets.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/CA%20SiteMinder%20WebAgent.aspx

WebAgent WEBAGENT PATTERN IS DISCONTINUED AND IS NO LONGER AVAILABLE FOR NEW

INTEGRATIONS

Integrates the SSOi Service with web-based or thin-client applications, enabling the authentication of internal users, global logoff, and the generation of management reports.

IdP to SP Federation

(SAML)

A SSOi SAML partnership where the SSOi service is the IdP and the application (typically external to the VA) is in the SP role. SSOi uses a previously authenticated session user as the subject for this IdP and generates a new SAML token for the partner application.

SSOi Secure Token Service

(STS)

Provides applications a method for obtaining a token for an authenticated user to pass in service calls. The interfaces for the STS service include WS-Trust messaging using SOAP with returned SAML token or REST with returned JSON token. The STS supports "direct" token exchange with the user or "indirect" token exchange with approved application partners and authentication tokens. These methods support PKI through Mutual TLS, PKI through WS-Security X.509 Profile, Active Directory through Kerberos, and the IAM SSOi session token.

SSOi OAuth SSOi OAuth 2.0 service, which provides client applications a “secure delegated access” to server resources on behalf of a resource owner. It is specifically implemented to support mobile applications.

Testing SSOi Integrated Applications In order to be able to test SSOi integrated applications in a lower environment (Dev, SQA and PreProd) you must first request that your account be added to the IAM Authorization DB in each environment needed. This is not nessecary in Production as all VA accounts are automatically added. Instructions for completing this process are covered on the Self-Service SSOi Account Setup Instructions.

Additionally, test persona manager has been created to allow for easier testing of SSOi integrated applications.

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/CA%20SiteMinder%20WebAgent.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/IdP%20to%20SP%20Federation%20%28SAML%29.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20Secure%20Token%20Service%20%28STS%29.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Oauth/Oauth.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20Setup.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20TPM.aspx