Applicable Doc. 5G - IAM Playbook - Prov.pdf

Last modified at 10/24/2023 2:52 PM by Vessels, Perry L. (Argil Solutions)

IAM Playbook Home

Prov Playbook This (and all IAM playbooks) playbook is a collaborative and continuously improved wiki/document. The purpose of the wiki/document is to provide as much useful technical information to integrating partners, if there is information that you feel is missing please let us know and we can add it or even give you contributor rights to add the information yourself!

Applications interested in using any of the IAM services should submit a service request (SR) using the Information Technology Request Portal (ITRP) to start the process.

References For information on choosing the right type of authorization see the Authorization Primer AcS Common Business Rules

Overview Identity Management Identity Management processes are the foundation for safeguarding VA applications and data. Accurate and timely identity data, triggered by business-driven lifecycle events and orchestrated by AcS, enables the effective authentication and authorization of users to harmoniously share and leverage sensitive information across VA internal LOBs and external business partners. To support this need, AcS provides a Provisioning service to manage a user’s digital identity lifecycle.

Additionally, within IAM the VA Master Person Index (VA MPI) serves as the authoritative source for identity within the VA. The Provisioning service is integrated with VA MPI to ensure the user identity is correlated to the VA MPI identity record.

Provisioning User provisioning is the process of associating a digital identity with one or more resource access accounts, which may serve as records for user data and permissions. This may include the creation, modification, deletion, suspension, or restoration of such accounts and also synchronizing user data.

Managing user accounts locally creates redundancy in collecting and managing user information. This may lead to inaccuracies and inconsistencies with user data that is stored in authoritative sources, and this may also create security vulnerabilities by maintaining accounts for terminated users.

By leveraging Provisioning, VA applications are able to centrally manage user information, attributes, roles, and accounts using data from authoritative identity sources. Once a manually intensive and disjointed process, VA’s Provisioning (Prov) service leverages automated and centralized workflows to enhance security and bolster efficiency. As a result, application administrators, who previously had to manually manage user administration, now have services available to automate the process.

Provisioning assigns the Security Identifier (SecID) as a unique user identifier for integrated applications to use for user authorization and audit.

SecID is a unique ID assigned to a user when they are added to the Provisioning system via an on-boarding event. SecID, once assigned, remains the same even if the user status with VA changes over time (i.e., a Veteran becomes a contractor and then later becomes an employee). SecID is the identifier used to correlate Provisioning records to VA MPI’s integration control number (ICN), which is the unique person identifier.

Provisioning aids in automating the on-boarding and off-boarding flows. Applications leveraging Provisioning gain an added benefit of automated account removal (deprovisioning) during off-boarding.

Page Rating

Categories No categories were selected

IAM Playbooks

Prov https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/_layouts/listform.aspx?PageType=4&ListId={FC3D90CA-C60C-44F7-9901-1C022384F074}&ID=29 https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx https://dvagov.sharepoint.com/sites/CMDM-RP/SitePages/What-is-ITRP-.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Authorization.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/AcS_Common_Business_Rules_Document.pdf javascript:;

javascript:;

javascript:;

javascript:;

javascript:;

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/IAM%20Playbook%20Home.aspx

The following table lists the detailed functions offered by the Provisioning service.

Function Description User Account Management Pattern

Provision / Modify / Deprovision Application Access

The Provisioning Service generates or updates account data in the VA application as a result of a user request, workflow, or administrator operation.

Managed by Provisioning (using SSOi Access Roles Header)

Managed in the Endpoint System

Managed by AD Security Groups

File Based Provisioning

Reconcile Account Data

The Provisioning Service synchronizes account data from the VA application to the provisioning system as a result of a workflow or administrator operation.

Managed by Provisioning (using SSOi Access Roles Header) Managed in the Endpoint System

Managed by AD Security Groups

Retrieve User The Provisioning Service returns user attributes for a given user.

Standards Based Interface (SPML or SCIM)

Search for User The Provisioning Service returns user attributes for a user given certain search criteria.

Standards Based Interface (SPML or SCIM)

Integration Patterns The Provisioning service provides both user and system interfaces. The user interfaces enable the submission and approval of access requests, delegation of approvers, and reporting capabilities. The system interfaces enable integration with applications to automate user account management, provisioning, and user account reconciliation. The interfaces available to support these functions are identified in the following diagram.

User Interface The Provisioning system provides a user interface that allows users to submit requests for access to integrated applications for themselves and for others (depending on the application). See the Provisioning User Interface playbook page for more information about the UI.

Application Interfaces The Provisioning Application Interfaces provide applications user management including role/access and privilege assignment. They also provide retrieval of user attributes.

The following diagram is a decision tree to help determine how applications should integrate with the Provisioning service for the purposes of user management. The Provisioning service provides a series of https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/Prov/ProvUserInterface.aspx interfaces that applications to manage their users and associated roles/access.

Depending on the application architecture, there may be an existing user repository that Provisioning can manage (add/update/remove users and roles). For these applications with an existing user repository the next step is to determine if there is an existing interface in place for user management. If an application does not have an existing user repository, Provisioning can act as the user repository and pass the application role as part of the SSOi authentication traits.

The Provisioning application integration patterns for user management are summarized in the following table.

User Account Management Pattern

What does it do?

Managed by Provisioning (using SSOi Access Roles Header)**

The Provisioning Service acts as the application user repository. User role/access information is passed via the SSOi headers or SAML assertion in the Access Roles attribute (see SSOi Authentication Trait Sets for details). Additionally, applications can retrieve additional information about the user role/access from the SPML interface. Refer to Provisioning Service Description document for details on the SPML service.

Managed in the Endpoint System

Enables the Provisioning Service to communicate directly with the application to manage user accounts, user data, roles, and permissions. Depending on the type of technology platform, these interfaces may manage applications remotely or require installation on the application systems. The following interfaces are currently available:

Existing Interface:

LDAP client – the Provisioning system offers a client LDAP interface for communications with an external https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20Authentication%20Trait%20Sets.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/Prov/Provisioning_Service_Description.pdf system offering an LDAP service interface for user account management.

JDBC interface – the Provisioning system offers JDBC connectivity to backend database for integrated applications in order to directly manage user accounts within the database. Optionally, the provisioning and deprovisioning actions can be performed via custom stored procedures provided by the integrating application.

Standards Based Interface:

SPML - the Provisioning SPML Web Service interface uses Service Provisioning Markup Language (SPML) to execute standard Provisioning operations. This interface leverages WSDL and SOAP for integration with applications. The application would send messages to Provisioning service containing user information and user management events for the Provisioning service to execute. Applications can send messages to the web service interface to retrieve user attributes. Refer to Provisioning Service Description document for details on the SPML service.

SCIM (System for Cross domain Iden�ty Management) - coming soon

Managed by Provisioning (Hybrid)**

Note: Not shown in the decision tree above. This pattern can be used instead of the Managed in the Endpoint System pattern for applications with their own user repository.

Enables the Provisioning Service to manage coarse grained access to an application (e.g. does a user have access to the application or not, what high level role the user has) while an application maintains it own user store and manages fine grained access/authorizations (e.g. what sites a user can access) independent from the Provisioning Service (likely using an existing process). In the Hybrid pattern, provisioned user role/access information is passed via the SSOi headers or SAML assertion in the Access Roles attribute (see SSOi Authentication Trait Sets for details) but the application still maintains a user repository with additional authorization information.

This pattern allows an application to quickly use the Provisioning Service to automate the workflow for gaining access to the application without requiring direct integration with the Provisioning Service.

Managed by AD Security Groups

For applications using AD Security Groups to manage application access and/or roles, Provisioning can automate the process of adding, updating and removing group membership.

**SSOi integration is a prerequisite for this pattern.

Provisioning Workflows: Request Types and Approvers In addition to an integration pattern (the way in which the application is integrated with the Provisioning Service), the provisioning workflows need to be defined. This consists of determining which request type(s) will be allowed and what approval model(s) will be used.

Request Types Provisioning service offers two different request types. Applications can have either or both.

Request for Self An enterprise user can log into Provisioning UI and request access to an application.

User may request an enterprise role to be assigned or an application access role.

https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Documents/Prov/Provisioning_Service_Description.pdf https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi%20Authentication%20Trait%20Sets.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/playbooks/Pages/SSOi/SSOi.aspx

When requesting application access, user is presented with a request form where they self-declare information that might be needed to gain access.

Self-service requests require approvals and therefore these workflows include one or more levels of approval with email notifications (to request submitter and approvers).

Request for Other An enterprise user who has elevated privileges (i.e. Supervisor/COR or application approver) can request access to an application on behalf of another user.

This workflow may optionally include additional levels of approval.

Approval Models Access requests submitted in Provisioning are routed to one or more approvers. There are two different approval models available; applications can have either or both.

Requires Supervisor Approval Requires approval of Supervisor (for VA employees) or COR (for contractors).

Provisioning request is first routed for Supervisor/COR approval.

If this is a “Request for Other” submitted by the individual’s Supervisor/COR, the request is considered to be approved.

Requires Application Approvers Approval Requires approval from one approver in designated approval group. This group can have different names, e.g., Application Approvers, Application Administrators.

Approvers are set up in groups; the Approver group can be set up in two ways:

one group approves all requests for the enterprise, multiple groups for different segments of users (e.g., by Station#,)

All Approvers for a specific request receive an email that the request is waiting for approval;

any approver can approve any request waiting in the queue.

Requests also requiring Supervisor/COR approval are routed to the Supervisor/COR first and then to the Application Approvers.