Applicable Doc. 5F - IAM Playbook - AMS.pdf

Last modified at 4/8/2021 3:31 PM by DeAntonio, Damien M. (Green Threads) (he/him/his)

IAM Playbook Home

AMS Playbook This (and all IAM playbooks) playbook is a collaborative and continuously improved wiki/document. The purpose of the wiki/document is to provide as much useful technical information to integrating partners, if there is information that you feel is missing please let us know and we can add it or even give you contributor rights to add the information yourself!

Applications interested in using any of the IAM services should submit a service request (SR) using the Information Technology Request Portal (ITRP) to start the process.

References AcS Common Business Rules

Overview The Authorization Management System (AMS) is designed to provide an enterprise-wide capability for managing individual authorizations for access to protected information. An Individual Authorization is an abstract concept and can be realized by different possible instances of concrete authorization types. Currently, the supported authorization types are Personal Representative Delegation (PR Delegation) and VA Online Health Delegate (VAOHD). Delegations are a type of authorization whereby a “delegator,” typically a Veteran or Beneficiary, delegates specific access privileges to a “delegate” such as Caregivers, Family members, Legal guardians, etc.

Authorizations are backed by signed documentation that substantiates intent to provide pertinent access. Such signed documentation is also managed by AMS. The following table lists the detailed functions offered by the AMS service.

Function Description Supporting Interfaces

Create Authorization Provides a method to create a new authorization AMS WS Interface

Create Authorization Event

Provides a method to create an authorization event associated with existing authorizations:

Revoke: To revoke an authorization Accept: To accept a Delegation Authorization Decline: To decline a Delegation Authorization Activate: To activate a PR Delegation type authorization Deactivate: To deactivate a PR Delegation type authorization AMS WS Interface

Retrieve Authorizations Provides a method to retrieve all authorizations granted to or granted by a user AMS WS Interface

Page Rating

Categories No categories were selected

IAM Playbooks

AMS

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/_layouts/listform.aspx?PageType=4&ListId={FC3D90CA-C60C-44F7-9901-1C022384F074}&ID=39 https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx https://dvagov.sharepoint.com/sites/CMDM-RP/SitePages/What-is-ITRP-.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/AcS_Common_Business_Rules_Document.pdf javascript:;

javascript:;

javascript:;

javascript:;

javascript:;

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx

Function Description Supporting Interfaces

Retrieve Authorization Document

Provides a method to retrieve a PDF document associated with a given authorization AMS WS Interface

Integration Patterns The AMS service provides both user and application interfaces. The delegation user interface enables end users to manage their authorizations. The AMS service provides an application interface for the creation, modification, or retrieval of authorization information. The user and application interfaces provided by AMS are identified in the following diagram.

Application Interfaces

The AMS application integration pattern is summarized in the following table.

Pattern What does it do?

AMS Web Service Interface

The Authorization Management Service (AMS) exposes web services to applications to remotely query authorization/relationship information. This webservice is a SOAP HL7v3 based web service provided by existing MVI service infrastructure (See VA Master Person Index).

In order to get the delegations the MVI retrieve with relationships is used. This is indicated using the modifyCode “MVI.COMP1.AMS”. See section 8.4 of the MVI service description for more information on MVI retrieve; 8.4.16 for a sample Retrieve with Relationships.

Additionally, IAM SSOe contains a flag (va_eauth_isDelegate) to let the application know if the authenticated user is setup as a delegate for another user. VA applications that are setup for delegated access can look for the va_eauth_isDelegate in the SSOe headers or SAML assertion and if true then query MVI to retrieve the delegation details.

User Interfaces

The delegation user interface allows for the self-service and staff management of authorizations. PowerPoint presentations are availble for the self-service UI (Veteran Delegation Tool [VDT]) and the staff facing UI to show the end user flow using these tools to create a delegation.

Pattern What does it do?

Delegation User Interface

Provides a UI for creating and revoking delegation authorization types. Includes a self-service and staff facing UI. Self-service UI is stand-alone SSOe integrated web application (Veteran Delegation Tool [VDT]). Staff facing UI is within MVI Toolkit integrated with SSOi.

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/VAMPI/VAMPI.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/MPI/MPI_Service_Description.pdf https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOe/SSOe.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/ssoe/SSOe%20Authentication%20Traits.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/IAM%20Documents/Forms/AllItems.aspx?RootFolder=/sites/OITEPMOIAM/IAM%20Documents/IAM%20Integrations/Delegation/IAM%20Delegation%20Demos