Applicable Doc. 13 - AcS VIP23 SSOe EU HD User Guide.pdf

Department of Veterans Affairs (VA)

Office of Information and Technology (OI&T)

Identity and Access Management (IAM) Access Services (AcS) Solution 4.0

Single Sign On - External (SSOe) End User (EU) & Help Desk (HD) User Guide

December 2022

Version 3.4

AcS Solution 4.0 VIP23

SSOe EU & HD User Guide i December 2022

Revision History

Date Revision Description Author

12/2/2022 3.4 Updated for VIP 23 By Light Professional IT Services

6/17/2022 3.3 Updated for VIP 21 By Light Professional IT Services

3/31/2022 3.2 Updated for VIP 20 By Light Professional IT Services

9/10/2021 3.1 Updated for VIP 18 By Light Professional IT Services

6/10/2021 3.0 Updated for VIP 17 By Light Professional IT Services

3/15/2021 2.9 Updated for VIP 16 By Light Professional IT Services

11/20/2020 2.8 Updated for VIP 15 By Light Professional IT Services

9/22/2020 2.7 Updated for VIP 14 By Light Professional IT Services

6/2020 2.6 Updated for VIP 13 By Light Professional IT Services

3/13/2020 2.5 Updated for VIP12 By Light Professional IT Services

12/11/2019 2.4 Updated for VIP11 By Light Professional IT Services

9/9/2019 2.3 Updated for VIP10 By Light Professional IT Services

12/04/2018 2.2 Updated for VIP9 By Light Professional IT Services

11/1/18 2.1 Updated to address VIP8 anomalies By Light Professional IT Services

10/10/2018 2.0 Updated for VIP8 By Light Professional IT Services

7/6/2018 1.9 Updated for VIP7 By Light Professional IT Services

4/9/2018 1.8 Updated for VIP6 By Light Professional IT Services

1/29/2018 1.7 Updated to address VIP5 anomalies By Light Professional IT Services

12/21/2017 1.6 Updated for VIP5 By Light Professional IT Services

9/21/2017 1.5 Updated for VIP4 By Light Professional IT Services

7/7/2017 1.4 Updated to address anomalies and 508 issues By Light Professional IT Services

6/19/2017 1.3 Updated for VIP3 By Light Professional IT Services

3/21/2017 1.2 Updated to address VIP1 Anomalies By Light Professional IT Services

1/6/2017 1.1 No changes for Sprint 29. Reviewed for formatting.

By Light Professional IT Services

SSOe EU & HD User Guide ii December 2022

Date Revision Description Author

11/04/2016 1.0 Initial Draft By Light Professional IT Services

SSOe EU & HD User Guide iii December 2022

Table of Contents

1. Introduction

Purpose

Document Orientation

Organization of the Manual

Assumptions

Coordination

Disclaimers

Documentation Conventions

References and Resources

Vendor Support

Enterprise Service Desk and Organizational Contacts

Help Desk Support

2. System Summary

System Configuration

Data Flows

User Access Levels

All Users

Privileged User

Continuity of Operation

3. Getting Started

Authentication Scenarios

Third Party On-Boarding (3POB)

Account Binding on Onboard Users

Federated User has Activated Application Account

Federated User has Existing Application Account

Federated User with No Local User Account

Federated User has no Valid Hash Value

Federations Using a CAC or PIV Card

Logging On - Help Desk

AccessVA Logon

ID.me Login Process

CAC Login Process

Logging on with PIV

DS Logon

Logging in with login.gov

Other login examples (Widget)

System Menu

Changing User ID and Password

Exit System

SSOe EU & HD User Guide iv December 2022

Log out from Active SSOe Session

Using SSOe Timeout Warning

Caveats and Exceptions

4. Using the Software

Register Credentials with a Service Provider from AccessVA Home Page

Obtaining Additional Information and Support

OAuth Authorization

Linking an NPI from a Non-VA Provider (NVAP)

Using VHIC Self Service App (VHIC-SS)

Logging in to VHIC-SS

Requesting a new VHIC

Requesting a Replacement VHIC

Checking status of VHIC

Log out from Active SSOe Session

5. Troubleshooting

FAQs

Special Instructions for Error Correction

6. Acronyms and Abbreviations

List of Tables

Table 1: Document Conventions Table 2: Degraded Performance Scenarios

Table 3: 3POB Table 4: 3POB - End User Table 5: Account Binding on Onboard Users Table 6: Federated User Has Activated Application Account

Table 7: Federated User has Existing Application Account Table 8: Federated User with No Local User Account Table 9: Federated User has no Valid Hash Value Table 10: Federations Using a CAC or PIV Card

Table 11: AccessVA Logon - Help Desk Table 12: ID.me Login Process Table 13: MyHealtheVet Login Process

Table 14: CAC Login Process Table 15: PIV Logon process Table 16: Register Credentials with a Service Provider from AccessVA Home Page

SSOe EU & HD User Guide v December 2022

List of Figures

Figure 1: SSOe/SSOe Service Figure 2: AccessVA home screen Figure 3: AccessVA home screen - expanded

SSOe EU & HD User Guide i December 2022

1. Introduction

Purpose

This user guide familiarizes users with the important features and navigational elements of the

Single Sign On – External (SSOe) application via Access Services (AcS).

Document Orientation

The Department of Veterans Affairs (VA) currently serves Veterans, their beneficiaries, and other VA stakeholders via services across many distributed and often operationally disjointed

Lines of Business (LOB). Based on this existing operating model, core Access Services (AcS) were established to definitively and consistently identify VA stakeholders and to establish supporting processes that increase the level of security protecting the identities, information, and interests of VA stakeholders.

Though VA serves the stakeholders across a vast enterprise of internal and external businesses and programs, it currently lacks a single, uniform method for identifying stakeholders and applying Access Management Services to safeguard its information resources. VA also lacks the capability to harmoniously share and leverage sensitive information across its internal LOBs and external business partners.

The VA AcS solution comprises individual subcomponents or groups, which are referred to as

VA AcS services. These VA AcS services are:

• Compliance Audit and Reporting (CAR)

• Electronic Signature (eSig)

• Single Sign On − Internal (SSOi)

• Provisioning (Prov)

• Credential Service Provider (VA Logon)

• Single Sign On − External (SSOe)

• Authorization Management Service (AMS)

The document includes Single Sign On – External (SSOe) only.

Organization of the Manual

Use this Single Sign On – External (SSOe) End User & Help Desk User Guide in conjunction with the IAM Access Services solution.

The intended audience of this manual includes:

• AcS End Users

• AcS Privileged Users

• AcS Help Desk Personnel

• HRC Personnel

SSOe EU & HD User Guide 2 December 2022

Refer to sections 2 - 4 for service-specific instructions.

Refer to the Table of Contents for an outline of the information included in this document.

Assumptions

This guide was written with the following assumed experience/skills of the audience:

• Users have basic knowledge of the operating system (such as the use of commands, menu options, and navigation tools)

• Users have been provided the appropriate active roles, menus, and security keys required for the specific AcS service

• Users are using the AcS service to do their jobs

• Users have validated access to the AcS service

• Users have completed any prerequisite training

Coordination

This section is not applicable.

Disclaimers

1.2.4.1. Software Disclaimer

This software was developed at the Department of Veterans Affairs (VA) by employees of the

Federal Government in the course of their official duties. Pursuant to title 17 Section 105 of the

United States Code, this software is not subject to copyright protection and is in the public domain. VA assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic. We would appreciate acknowledgement if the software is used. This software can be redistributed and/or modified freely provided that any derivative works bear some notice that they are derived from it, and any modified versions bear some notice that they have been modified.

1.2.4.2. Documentation Disclaimer

The appearance of external hyperlink references in this manual does not constitute endorsement by the Department of Veterans Affairs (VA) of a given website or the information, products, or services contained therein. The VA does not exercise any editorial control over the information you may find at these locations. Such links are provided and are consistent with the stated purpose of the VA.

SSOe EU & HD User Guide 3 December 2022

Documentation Conventions

Table 1: Document Conventions

Convention Description

Notes Notes provide additional information including references to additional reading material. Notes begin with the word “Note” in all capital letters and boldface font.

Names of onscreen computer controls (buttons, fields, tabs, options, links, etc.)

The labels of buttons, fields, tabs, menus, links are shown exactly as they display on screens (where known) and are in Boldface type.

Series A right arrow (→) indicates a sequence of menu selections.

References and Resources

Refer to the following AcS documentation for further information.

• The AcS Production Operations Manual (POM) contains additional or more detailed routine operations and administrative procedures and is located in the following SharePoint location.

Vendor Support

Contact the appropriate vendor for application-specific needs.

• Oracle Middleware Product Support:

o http://www.oracle.com/us/support/library/lifetime-support-middleware-

069163.pdf

• Broadcom (Formerly Computer Associates (CA)) Release and Lifecycle Support:

https://www.broadcom.com/products/enterprise-software

• Microsoft Product Lifecycle Support:

o http://support.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Micro soft+Internet+Information+Services+8.5&Filter=FilterNO

• Apache Tomcat Product Support and Lifecycle:

o https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/util/LifecycleSupport.html o https://tomcat.apache.org/contact.html

• WebSphere DataPower \ Tivoli Product Support and Lifecycle:

o http://www-01.ibm.com/software/sysmgmt/products/support/lifecycle/ o http://www-01.ibm.com/software/support/lifecycle/index_a_z.html o http://www-

01.ibm.com/software/support/lifecycleapp/PLCSearch.wss?q=DataPower&scope

=S962652E67398D77-X007925I73652A47&sort=P&ibm-search.x=20&ibm-search.y=17 https://dvagov.sharepoint.com/sites/OITEPMOIAM/IAM%20Documents/Forms/AllItems.aspx?viewid=00000000%2D0000%2D0000%2D0000%2D000000000000&id=%2Fsites%2FOITEPMOIAM%2FIAM%20Documents%2FIAM%20Development%20Documentation%2FByLight%20IAM%20Contract%20Deliverables%20TO%2D17%2F10001AV%2DRelease%2DDeployment%20Package%2FVIP%2014%2FProduction%20Operations%20Manual%20%28POM%29 http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf http://www.oracle.com/us/support/library/lifetime-support-middleware-069163.pdf https://www.broadcom.com/products/enterprise-software http://support.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Microsoft+Internet+Information+Services+8.5&Filter=FilterNO http://support.microsoft.com/lifecycle/search/default.aspx?sort=PN&alpha=Microsoft+Internet+Information+Services+8.5&Filter=FilterNO https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/util/LifecycleSupport.html https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/util/LifecycleSupport.html https://tomcat.apache.org/contact.html http://www-01.ibm.com/software/sysmgmt/products/support/lifecycle/ http://www-01.ibm.com/software/support/lifecycle/index_a_z.html http://www-01.ibm.com/software/support/lifecycleapp/PLCSearch.wss?q=DataPower&scope=S962652E67398D77-X007925I73652A47&sort=P&ibm-search.x=20&ibm-search.y=17 http://www-01.ibm.com/software/support/lifecycleapp/PLCSearch.wss?q=DataPower&scope=S962652E67398D77-X007925I73652A47&sort=P&ibm-search.x=20&ibm-search.y=17 http://www-01.ibm.com/software/support/lifecycleapp/PLCSearch.wss?q=DataPower&scope=S962652E67398D77-X007925I73652A47&sort=P&ibm-search.x=20&ibm-search.y=17 http://www-01.ibm.com/software/support/lifecycleapp/PLCSearch.wss?q=DataPower&scope=S962652E67398D77-X007925I73652A47&sort=P&ibm-search.x=20&ibm-search.y=17

SSOe EU & HD User Guide 4 December 2022

• Axiomatics Product Support:

o https://support.axiomatics.com/

Enterprise Service Desk and Organizational Contacts

Help Desk Support

If you experience a production SSOe issue, contact ESD:

• If External (SSOe/VAAFI), Contact the HRC Help Desk at 800-983-0937 o Hours of Operation: Monday through Friday 7:00 a.m. to 7:00 p.m., Central Time.

o Online: https://yourit.va.gov/ for self-service support (Google Chrome web browser and VA Network access required)

• If you experience a non-production SSOe issue, click on the link below and enter issue information:

https://dvagov.sharepoint.com/sites/OITEPMOIAM//lists/iam%20environment%20tasks/ active%20tasks.aspx

2. System Summary Access Services (AcS) focuses on ensuring the correct individuals have access to the correct resources and includes the process of controlling and granting access to satisfy requests for access to resources. Key capabilities include Provisioning, Authentication, Authorization, and

Audit. Additionally, Directory Services play a complementary role to Access Management

Services. The Access Management infrastructure is deployed at the VA Enterprise Cloud

(VAEC) facility in Virginia, with the failover facility in Texas. Access Services comprises the following capabilities:

• Single Sign On − Internal (SSOi) – Provides Single Sign-on functionality for internal users utilizing the Personal Identification Verification (PIV) card, Active Directory (AD) or

Windows authentication

• Single Sign On − External (SSOe) – Provides authentication services and Single Sign-on services supporting VA’s outward-facing applications, as well as Department of Defense

(DoD) applications and portlets

• Electronic Signature (eSig) – Provides capability for digital signatures to external users

• Provisioning (Prov) – Automates processes, rules, and procedures for creating, approving, granting, and removing system access; is the VA enterprise user store and AuthDB for user traits

• Compliance Audit and Reporting (CAR) – Provides audit and reporting capability based on data made available to the Access Services

• Authorization Management Service (AMS) – Offers consumer applications within VA a standardized approach for managing Veteran Authorizations, eliminating the need to create proprietary application-specific solutions https://support.axiomatics.com/ https://dvagov.sharepoint.com/sites/OITEPMOIAM/lists/iam%20environment%20tasks/active%20tasks.aspx https://dvagov.sharepoint.com/sites/OITEPMOIAM/lists/iam%20environment%20tasks/active%20tasks.aspx

SSOe EU & HD User Guide 5 December 2022

The AcS Single Sign On – External (SSOe) service is a component of the Identity and Access

Management program.

SSOe functionality:

• Access an application via AccessVA

System Configuration

The Single Sign On – External (SSOe) service uses the already deployed architecture that supports the VA Authentication Federation Infrastructure (now referred to as SSOe, formally called VAAFI). SSOe provides authentication services and single sign-on services to the VA’s outward-facing applications, as well as to DoD applications, portlets, and other VA partners. An example of this is Veterans Group Life Insurance (VGLI), hosted by Prudential Insurance

Company. AccessVA (AcVA) provides a website for Web Self Service applications to accept multiple sign-on credentials from external providers. The following graphic depicts SSOe interaction patterns. As the graphic shows, users can start at various places, but ultimately their session with an application proxies through SSOe.

SSOe EU & HD User Guide 6 December 2022

Figure 1: SSOe/SSOe Service

Partners can use the OAuth protocol to authorize mobile and web-based applications access to users’ resources. Users will be prompted to permit or deny access to the application for a given resource. Users are prompted only the first time the application requests access. The VAAFI

OAuth service will also allow users to register their devices to access services.

Data Flows

Refer to System Configuration (Section 2.1).

User Access Levels

All Users

See sections 3 and 4 for application usage.

SSOe EU & HD User Guide 7 December 2022

Privileged User

SSOe has no Privileged User roles.

Continuity of Operation

The IAM IT Contingency Plan Continuity of Operations Plan (COOP) ensures that Access

Services are available if a system or facility failure occurs. The System Design Document (SDD) for each AcS service, the AcS Incident Response Plan, the IAM DR Plan, and the AcS

Production Operations Manual (POM) identify the solutions in place to ensure that AcS functionality is available. The following table addresses the different scenarios.

Table 2: Degraded Performance Scenarios

Scenario Type Description Mitigation

Hardware Failure The loss of a hardware device supporting the

Access Services Solution

Deploy hardware in clusters with automatic failover

Loss of

Power/Circuitry

The loss of electrical power or network connections within facilities

Redundant power and network connectivity in data center

Loss of

Phone/Internet

The loss of phone services to facilities Redundant phone/internet connectivity to data center

Loss of Site The loss of the primary site due to a natural or man-made disaster

Transition Access Services functionality to the Disaster Recovery

Site

3. Getting Started

Authentication Scenarios

Third Party On-Boarding (3POB)

3.1.1.1. Help Desk

Table 3: 3POB

Step Action

1. Third Party On-Boarding (3POB) is a soft onboarding confirmation feature. DS Logon and CAC users will go through a confirmation process in the background. Other VA Logon users also may be soft onboarded depending upon the data that they send.

The first time a user authenticates with a credential, if VA requires more information for onboarding, a screen similar to the one shown below will display. It will be partially filled with VA Logon -provided data. If the data is incorrect, the user must contact VA Logon.

SSOe EU & HD User Guide 8 December 2022

Step Action

SSOe EU & HD User Guide 9 December 2022

Step Action

2. The items below are Third Party Credential Onboarding messages.

Message Explanation Resolution

Confirmation

Success

This page displays upon successful

Third Party Onboard Confirmation.

SSOe logs out the user.

The user should select the OK button and log in to the application via the page that the application has specified to display.

Confirmation

Failure (CE)

This page displays upon failure during the Third Party Onboard Confirmation process. The failure page displays the transaction ID associated with the user’s original SAML request to help identify the request in the logs. The user is logged out, and after selecting the OK button, the user is taken to the default unauthenticated link for the originally targeted application.

The user data can also be investigated to see if there is a mismatch between systems.

3.1.1.2. End User

Table 4: 3POB - End User

1. Fill in identity verification information on the Third Party Onboarding (3POB) form and click Submit.

SSOe EU & HD User Guide 10 December 2022

SSOe EU & HD User Guide 11 December 2022

Step Action

2. Wait on the AccessVA registration screen while the 3POB process completes. Estimated average wait time for Third Party Onboarding processing to complete is 60 seconds.

3. After successful 3POB processing, you will receive confirmation of the submission and be prompted to click OK to complete the process and log back in to access the application.

NOTE: The user is unauthenticated when they click OK and must log in again.

4. Log back in. Additional header information will be visible from having completed 3POB.

NOTE: If the user cancels past the 3POB form, they will continue to the application and have CSP-and SSOe-created headers only (hash and Transaction ID).

Account Binding on Onboard Users

3.1.2.1. End User

Table 5: Account Binding on Onboard Users

Step Action

1. With the Portal Strategy, additional attributes, such as the Electronic Data Interchange Personal Identifier

(EDIPI), Integration Control Number (ICN), and Participant ID (PID), are added to the HTTPS headers before sending the user on to the application.

SSOe EU & HD User Guide 12 December 2022

Step Action

2. In some instances, the VA application can bind the authenticated user to the local user using the additional attributes received by the get traits by CSPID call to MVI rather than by using the unique identifier.

• When this is the case, there is no need to create the mapping table for the identifier

• The VA application should be able to authenticate the user with the additional traits. If the user is not found, then the application’s registration process should be invoked.

Federated User has Activated Application Account

3.1.3.1. End User

Table 6: Federated User Has Activated Application Account

Step Action

1. The application receives the HTTPS connection from SSOe with the unique identifiers, such as the

SecID, in the HTTPS header.

2. The application parses these values from the HTTPS request header.

3. The application then searches its user repository for a matching identifier.

4. Since the federated user has registered with the local application in a prior visit, the application will find the user’s unique identifier in its database.

5. The application allows the user to access protected pages/resources per the selected user account’s current permissions.

Federated User has Existing Application Account

3.1.4.1. End User

Table 7: Federated User has Existing Application Account

Step Action

1. 1

The application extracts the unique identifier from the incoming header and performs a search for the user in its database; however, the application will not find the unique identifier in its user repository.

2. 2

In this case, the application logic initiates the normal logon process and searches for any matching user profile data.

3. If the application finds matching data, it associates the unique identifier value from the HTTPS headers, such as the SecID, with the matched user to activate the user for future visits.

SSOe EU & HD User Guide 13 December 2022

Federated User with No Local User Account

3.1.5.1. End User

Table 8: Federated User with No Local User Account

Step Action

1. The user logs with SSOe integrated CSP and is redirected back to SSOe.

• When the user arrives at the application, the HTTPS headers contain the user’s identifying information.

2. Since the user does not have a profile in the application database, the query against the application database returns no result for any identifier.

3. At this point, the application loads its user registration page and instructs the user to fill in all required information.

4. After submitting the new information, the application creates a new user record with the hash value and

Security ID (SecID), which correlates a single identity regardless of whether a specific CSP sends a specific identifier such as the EDIPI.

Federated User has no Valid Hash Value

3.1.6.1. End User

Table 9: Federated User has no Valid Hash Value

Step Action

1. With the Portal Strategy, additional attributes, such as the Electronic Data Interchange Personal Identifier

(EDIPI), Integration Control Number (ICN), and Participant ID (PID), are added to the HTTPS headers before sending the user on to the application.

2. In some instances, the VA application can bind the authenticated user to the local user using the additional attributes received by the get traits by CSPID call to MVI rather than by using the unique identifier.

• When this is the case, there is no need to create the mapping table for the identifier.

• The VA application should be able to authenticate the user with the additional traits.

3. If the user is not found, then the application’s registration process is invoked. This integration pattern does not allow for SSOe to maintain the SSO session state.

Federations Using a CAC or PIV Card

3.1.7.1. End User

Table 10: Federations Using a CAC or PIV Card

SSOe EU & HD User Guide 14 December 2022

1. Accessing VA portals or applications using a CAC or PIV card is not any different than using other

CSPs.

• End users must have a card reader attached to their personal computers (PCs) to authenticate in this fashion.

• Once the user certificate has been validated and thus user authenticated with SSOe, users must then bind their SSOe credential to the local credential used with the application they are trying to access.

• To complete the binding process, users can access the PublicKey infrastructure (PKI) logon page using the link on the registration page or can login using their PKI credential at

AccessVA.

• CA/PIV options are not available on mobile devices.

2. AccessVA page displays all of the applications that are members of the PKI federation.

3. The first time the user accesses an application from AccessVA, a process similar to that described in

Scenario 1 using the information in the HTTPS headers will be available to the application to allow the application to bind with the user’s local profile.

4. Subsequent attempts to authenticate on AccessVA with a PIV or CAC require the user to have the card in the PC card reader.

• The ActivClient middleware prompts the user to select the certificate used to authenticate with SSOe and enter the PIN to gain access.

• Since the certificate is trusted, the user is authenticated to AccessVA and AccessVA displays the user’s name and assurance level.

• The user does not require additional authentication to connect to any of the applications within the PKI federation to which the user has access and is bound unless the application chooses to require additional authentication.

SSOe EU & HD User Guide 15 December 2022

Logging On - Help Desk

AccessVA Logon

Table 11: AccessVA Logon - Help Desk

Step Action

1. The AccessVA homepage shows categories, that when expanded show applications that are relevant to that role. Applications will show up under multiple categories. Click on the a category to expand.

SSOe EU & HD User Guide 16 December 2022

2. In this example, the Service Member category is selected, showing the relevant applications.

3. The CSPs have links to authenticate and go into the application, register an account with the CSP, and learn more about the CSP. Applications may set the login buttons on their sites to send users to a similar

AccessVA screen with the application preselected.

SSOe EU & HD User Guide 17 December 2022

ID.me Login Process

Table 12: ID.me Login Process

Step Action

1. Select the category relative to the user’s role. Selecting an application opens a new page and displays a list of CSPs.

2. The CSPs have links to authenticate and go into the application, register an account with the CSP, and learn more about the CSP. Applications may set the login buttons on their sites to send users to a similar

SSOe EU & HD User Guide 18 December 2022

3. Select ID.me from the application selected:

4. Once ID.me is selected, you will be notified of a redirect. Select Accept if you agree.

SSOe EU & HD User Guide 19 December 2022

Step Action

5. After being redirected to ID.me, you will be prompted to login. Enter login credentials and select ‘Sign in’.

SSOe EU & HD User Guide 20 December 2022

6. Select option on how to receive login code. (text message or Phone call)

SSOe EU & HD User Guide 21 December 2022

7. Enter the 6-Digit code provided and select ‘Continue’

ID.me will return to Access VA and authenticate.

SSOe EU & HD User Guide 22 December 2022

Table 13: MyHealtheVet Login Process

Step Action

1. Applications are displayed on the home page. Selecting an application opens a new page and displays a list of CSPs.

2 Click on the application that you wish to login to (and use your My HealtheVet Credential)

SSOe EU & HD User Guide 23 December 2022

3 Click on the button labelled “Sign in with My HealtheVet”

4 Click on ‘Accept’ on the popup window.

SSOe EU & HD User Guide 24 December 2022

5 On the next screen, enter your Username and Password to login using your My HealtheVet credential.

6 If Credentials were entered correctly and you have access to the application, you will be suceessfully logged in.

SSOe EU & HD User Guide 25 December 2022

CAC Login Process

Table 14: CAC Login Process

Step Action

1. Applications are displayed on the home page. Selecting an application opens a new page and displays a list of CSPs. (Note that PIV/CAC Options will not be displayed on mobile devices)

SSOe EU & HD User Guide 26 December 2022

Step Action

2 The CSPs have links to authenticate and go into the application, register an account with the CSP, and learn more about the CSP. Applications may set the login buttons on their sites to send users to a similar

Click on “Sign in with DOD CAC Card”.

3 Selecting The DOD CAC Card option will display the Secure Login Redirect screen shown below. Click

Accept.

SSOe EU & HD User Guide 27 December 2022

Step Action

4 After Clicking Accept, Pick the correct CAC Certificate from the window, click OK, then enter PIN when prompted.

5 You will be redirected to your application if the certificate and PIN match, and you have access to the application.

SSOe EU & HD User Guide 28 December 2022

Logging on with PIV

Table 15: PIV Logon process

1. Applications are displayed on the home page. Selecting an application opens a new page and displays a

SSOe EU & HD User Guide 29 December 2022

Step Action

2. The CSPs have links to authenticate and go into the application, register an account with the CSP, and learn more about the CSP. Applications may set the login buttons on their sites to send users to a similar

Click on “Sign in with VA PIV Card”.

3. After selecting PIV authentication, you will be shown a Secure Login Redirect notice where PKI authentication will occur.

SSOe EU & HD User Guide 30 December 2022

Step Action

4. After accepting the redirect, a certificate selection will be presented, select the PIV certificate., then enter

PIN when prompted.

5. While PKI authentication proceeds, you will be presented with the following screen.

SSOe EU & HD User Guide 31 December 2022

6. Once authorization is successful, you will be directed to the application. (In this example, SEP)

SSOe EU & HD User Guide 32 December 2022

7. If you return to AccessVA, you will be already authenticated to login to other PIV enabled applications.

SSOe EU & HD User Guide 33 December 2022

DS Logon

Table 16: DS Logon process

1. Applications are displayed on the home page. Selecting an application opens a new page and displays a

SSOe EU & HD User Guide 34 December 2022

Step Action

2 The CSPs have links to authenticate and go into the application, register an account with the CSP, and learn more about the CSP. Applications may set the login buttons on their sites to send users to a similar

Click on “Sign in with DS Logon”.

3 Selecting The DS Logon option will display the Secure Login Redirect screen shown below. Click

Accept.

SSOe EU & HD User Guide 35 December 2022

4. You will be presented with the DS Logon screen, enter credentials to login.

SSOe EU & HD User Guide 36 December 2022

SSOe EU & HD User Guide 37 December 2022

Logging in with login.gov

Table 17 : Using Login.gov

1. Select an SSOe application that uses Login.gov as a CSP, click the Login.gov button to continue.

SSOe EU & HD User Guide 38 December 2022

2. Click ‘Accept’ on the Secure Login Redirect screen.

SSOe EU & HD User Guide 39 December 2022

Step Action

3. You will be redirected to login.gov and prompted to enter your Email address and Password. Press ‘Sign in’

SSOe EU & HD User Guide 40 December 2022

Step Action

4. Select one of the options below to complete authentication. In this example, we will use the phone number on file to send a security code via SMS.

SSOe EU & HD User Guide 41 December 2022

5. Once you receive the authentication code, enter it in the field provided and click ‘Submit’.

6. Once the steps are completed sucessfully, You will be redirected to the application.

SSOe EU & HD User Guide 42 December 2022

Other login examples (Widget)

3.2.7.1. Embedded

Step Action

1. The example shown here demonstrates AccessVA functionality embedded on a partner’s site, in this case MyHealthevet. The CSP select page is shown in a window on the main page.

https://www.myhealth.va.gov/mhv-portal-web/user-login?redirect=/mhv-portal-web/home

2. Clicking on a CSP button

SSOe EU & HD User Guide 43 December 2022

3. Clicking on a CSP will notify you that you will be redirected to login. Click ‘Accept’ to continue. You will be redirected to a sign-in partner.

3.2.7.2. Pop-in

1. The example shown here uses a button to initiate a CSP modal on a website. The site shown is AMS/VDT. https://eauth.va.gov/AMS_home/

2. Click on the ‘Log In’ button to initiate the CSP select modal.

SSOe EU & HD User Guide 44 December 2022

3. Click on a CSP to continue. You will be redirected to the corresponding sign-in partner.

SSOe EU & HD User Guide 45 December 2022

3.2.7.3. Oauth Widget

1. This example uses the Oauth widget page which uses a CSP select page optimized for mobile: VA Mobile Oauth widget page.

2. Using the link above will take you the the page shown below:

3. Click on a Sign-in partner’s icon and you will be taken to the page below, Click

‘Accept’ to be redirected to the sign-in partner’s page.

https://eauth.va.gov/accessva/widget?client_id=VAMobile&appId=oauth.VAMobile&redirect_uri=vamobile%3A%2F%2Flogin-success&scope=openid&response_type=code&response_mode=query&code_challenge_method=S256&code_challenge=tDKCgVeM7b8X2Mw7ahEeSPPFxr7TGPc25IV5ex0PvHI&state=12345

SSOe EU & HD User Guide 46 December 2022

SSOe EU & HD User Guide 47 December 2022

System Menu

3.2.8.1. AccessVA Home Screen

Figure 2: AccessVA home screen

To view applications, click on the desired category (eg: “I am a Veteran”) to expand section.

SSOe EU & HD User Guide 48 December 2022

Figure 3: AccessVA home screen - expanded

1. The About AccessVA link navigates to a page that shows detailed information about

AccessVA.com, including FAQs.

2. Contact Us provides email and phone contact information in case a user has difficulty accessing AccessVA.

3. Within the red box is a list of categories, clicking on a category displays applications relevant to that category.

3.2.8.2. Existing session detection

In the event that a user is already logged into an SSOe session and attempts to login to another application that uses the same CSP (and LOA), the existing session will be detected and the user directed to the application without providing credentials.

Note: Application partners will opt in for this feature, so the application may not automatically detect session by default.

Scenario 1: Via Access VA website. Logged into ROES using PIV at LOA3 in Internet Explorer:

SSOe EU & HD User Guide 49 December 2022

Table 18: Session detection - Scenario 1

1. Navigate to AccessVA: https://eauth.va.gov/accessva/, you will notice that you are authenticated (in this case with PIV at IAL 3, AAL 3)

2. Select an application that uses a compatible CSP and LOA, in this case SEP.

3. The following screen will pop up and once the ‘Accept’ button is clicked, the user will be directed to the application utilizing the existing authentication.

SSOe EU & HD User Guide 50 December 2022

Scenario 2: Authenticated in SSOe using PIV at LOA 3 and Click an application widget on a partner site.

Table 19: Session Detection - Scenario 2

1. A button (widget) similar to the one below will be available on a partner site to login to an SSOe

2. The system will detect that there is an existing session. The messgae below will be displayed for 3 seconds, then user will be directed to ROES.

Changing User ID and Password

Table 20: Changing User ID and Password

1. To change your DS Logon password, login to My Access Center at https://myaccess.dmdc.osd.mil https://myaccess.dmdc.osd.mil/

SSOe EU & HD User Guide 51 December 2022

2. Once logged into My Access Center, you will see Manage DS Logon Account. Beneath that are several buttons. Select Change password.

SSOe EU & HD User Guide 52 December 2022

Step Action

3. You may change your password by correctly responding to three challenge questions saved to your account profile. If you have forgotten your personalized answers, then you will have the option to use your stored email address to reset your password.

Exit System

Log out from Active SSOe Session

Depending on the application, logging out may completely close the SSOe session or it may return you to the AccessVA Authenticated Home Page, where you can elect to access another application or log completely out of the active SSOe session. Take the following steps to close the SSOe session from the AccessVA Authenticated Home Page.

Table 21: Log Out from Active SSOe Session

Step Action

1. Log out of the application.

2. On the Authenticated AccessVA Home Page, click the Logout button.

SSOe EU & HD User Guide 53 December 2022

Step Action

3. AccessVA will display the following logout prompt. Close all browser tabs and windows to completely log out.

Using SSOe Timeout Warning

Overview: SSOe Timeout Warning implementation is for enabling timeout warning for SSOe integration partners. Assumption is that applications will include a JavaScript file responsible of showing timeout warnings and allowing timeout extension. Please note that the entire logic controlling the display of the timeout warning is done on the application side. The implementation allows the user to extend the session 2 minutes prior to time out in an event the session is left idle for 10 minutes. In an event the user selects to extend the session, the application will reset the session idle timeout after validation session timeout against SSOe.

The users will be presented with similar dialog box for extending or terminating their session.

SSOe EU & HD User Guide 54 December 2022

Figure 4: Session Timeout Warning

Caveats and Exceptions

N/A

4. Using the Software

Register Credentials with a Service Provider from AccessVA Home Page

From the AccessVA Home Page, take the following steps to use the AccessVA Registration

Wizard to register credentials or create an account with a CSP.

SSOe EU & HD User Guide 55 December 2022

Table 16: Register Credentials with a Service Provider from AccessVA Home Page

Step Action

1.

Navigate to the AccessVA portal: https://eauth.va.gov/accessva/

2.

Select the icon of the application you want to access.

3. Click the button of the service provider that you want use to access the application. A page displays informing you that you are being directed to a secure webpage to register with your selected service provider or to log in to your account.

SSOe EU & HD User Guide 56 December 2022

Step Action

4.

If you need to register with a sign-in partner, click the link circled in the image above.

5. Click Next.

6. Click Next.

SSOe EU & HD User Guide 57 December 2022

7. Select a sign-in partner to register with by clicking on the desired button.

8. You may click Terms of VA System use to view the privacy policy.

SSOe EU & HD User Guide 58 December 2022

9. Once you have read the privacy policy, click Back to return to the previous screen.

10. Click Accept to provide consent.

11. Once the agreement is accepted, you are directed to your selected site to register.

Obtaining Additional Information and Support

AccessVA provides a number of options that provide you with information about using the portal. The options vary depending on the current AccessVA page.

SSOe EU & HD User Guide 59 December 2022

Table 23: Obtain Additional Information and Support

Step Action

1. On the AccessVA Home page, to learn more about a service provider you can use for a specific application:

a. Select the icon of the application you want to access. A new page displays a list of service providers that you can use to access the application.

b. Click the Learn More link. A new page opens with links for each service provider through which a user can log in to the selected application.

c. Click the link for the service provider for which you want information. Information for that service provider displays. Click Back to return to the list of service providers for the

2. From an application’s home page, to learn about the service providers available for the application:

a. Click the AccessVA button. An AccessVA widget opens and displays a list of service providers you can use to access the application.

b. Click the Learn More link. The page displays links for each service provider through which a user can log in to the application.

NOTE: This is the same page that opens through the AccessVA Learn More link in step 1, above.

c. Click a link for the service provider for which you want information. Information for that service provider displays. Click Back to return to the list of service providers for the

SSOe EU & HD User Guide 60 December 2022

Step Action

3. On any AccessVA page, to learn more about AccessVA services, service providers, and VA websites available through AccessVA:

a. Click the About AccessVA link in the menu. The About AccessVA page opens. The left panel displays a list of links for additional information. The right panel displays a list of

FAQs.

b. Click an FAQ link in the right to display information on the subject you selected.

c. To return to the AccessVA Home page, select the AccessVA Home link in the menu.

SSOe EU & HD User Guide 61 December 2022

Step Action

4. From the About AccessVA page, to learn about service providers:

a. Click the AccessVA Sign-In Partners link in the left panel. The Sign-In Partners About page displays in the right panel with a list of service providers. By default, information for DS

Logon displays.

b. Click the link in the right panel for the service provider for which you want information.

Information for that service provider displays in the right panel.

SSOe EU & HD User Guide 62 December 2022

Step Action

5. From the About AccessVA page, to learn about websites that you can access through AccessVA:

a. Click the AccessVA Enabled Websites link in the left panel. The right panel displays a list of websites and applications.

b. Click a link in the right panel for the website for which you want information. Information for that website displays in the right panel.

c. Click the Back button to return to the list of websites.

d.

SSOe EU & HD User Guide 63 December 2022

Step Action

6. On any AccessVA page, to get additional support for using AccessVA:

a. Click the Contact Us link. The right panel contains contact information of the IAM Help

Desk.

NOTE: This page also displays when you click the Contact Us link in the left panel of the AccessVA About page.

b. To send an email to the Help Desk, click the link in the right panel.

c. To return to the AccessVA Home page, select the AccessVA Home link in the menu.

OAuth Authorization

Prior to accessing a specific resource, the client application will request authorization from the resource owner (user).

Prerequisite: A VA application has requested access to a protected resource to which the user has not previously granted access.

SSOe EU & HD User Guide 64 December 2022

Table 24: OAuth Authorization

1. The Consent to Authorize prompt displays.

2. To authorize access, check all allowed scopes, select Permit and then click the Submit button. You are then redirected to the requesting application.

Linking an NPI from a Non-VA Provider (NVAP).

The Link My NPI application provides an interface for Non-VA providers to link their National

Provider Identifier number to their VA identity.

Prerequisite: Registered CSP credential with VA identity. The example below assumes an ID.me credential will be used.

SSOe EU & HD User Guide 65 December 2022

Table 25: Link my NPI

1. Navigate to https://eauth.va.gov/linkmynpi/. Login using the VA identity

2. Click on the Log In button, The example shown will assume a registered credential.

https://eauth.va.gov/linkmynpi/

SSOe EU & HD User Guide 66 December 2022

3. Once logged in, enter your NPI in the field below and click ‘Continue Registration’.

4. If the number is valid, it will be linked to your VA account and message below will be displayed.

SSOe EU & HD User Guide 67 December 2022

5. If your account is already linked, you will see the message below when logging in.

6. Clicking on the AccessVA link after linking NPI, will exit the LinkMyNPI application and take you to AccessVA with the Partner section opened.

SSOe EU & HD User Guide 68 December 2022

Using VHIC Self Service App (VHIC-SS)

The VHIC Self-Service application allows Veterans to request new or replacement cards without having to visit their local VA facility.

Logging in to VHIC-SS

Logging in to VHIC-SS

Step Action

1.

Navigate to the AccessVA portal: https://eauth.va.gov/accessva/ https://eauth.va.gov/accessva/

SSOe EU & HD User Guide 69 December 2022

Step Action

Select the ‘I am a Veteran’ group to expand it.

3.

Click on the VHIC Icon:

SSOe EU & HD User Guide 70 December 2022

Step Action

4.

Select your sign-in method:

SSOe EU & HD User Guide 71 December 2022

Requesting a New VHIC

If you qualify to apply for a new card, the following screen displays below:

Read the requirements and ensure to have the following forms of ID, then click ‘Continue’

1. Unexpired State Issued Driver’s License, Passport, or a Federal, State, or Local

Government Issued Photo ID containing name, address, and date of birth (DOB).

2. Recent photo. Accepted file formats are JPG, TIFF, GIF, PNG, and BMP. For best results use a 400x400 pixel JPG.

SSOe EU & HD User Guide 72 December 2022

3.

Click ‘Choose File’ under the image to select the image of your Driver’s license.

Click ‘Continue’.

SSOe EU & HD User Guide 73 December 2022

4.

Click ‘Choose File’ to select photo image.

When complete, a preview of the image will display.

SSOe EU & HD User Guide 74 December 2022

5.

Select your mailing address from the options below:

If you select ‘My address is not shown’, call the VA for assistance.

Click ‘Continue’

SSOe EU & HD User Guide 75 December 2022

6.

Select your email or enter a new email address (twice for confirmation).

SSOe EU & HD User Guide 76 December 2022

7.

Review the confirmation screen and if the information is notaccurate, click ‘Cancel Request’, otherwise click ‘Submit Request’ to complete your application.

SSOe EU & HD User Guide 77 December 2022

Requesting a Replacement VHIC

VHIC-SS Submitting a replacement request for VHIC

If you qualify to replace you VHIC, the following screen displays below:

Read the requirements and ensure to have the following and then click ‘Continue’.

1. Unexpired State Issued Driver’s License, Passport, or a Federal, State, or Local

Government Issued Photo ID containing name, address, and date of birth (DOB).

2. Recent photo. Accepted file formats are JPG, TIFF, GIF, PNG, and BMP. For best results use a 400x400 pixel JPG.

SSOe EU & HD User Guide 78 December 2022

3.

Click ‘Choose File’ under the image to select the image of your Driver’s license.

Click ‘Continue;.

SSOe EU & HD User Guide 79 December 2022

4.

Click ‘Choose File’ to select photo image.

When complete, a preview of the image will display.

SSOe EU & HD User Guide 80 December 2022

5.

Select your mailing address from the options below:

If you select ‘My address is not shown’ call the VA for assistance.

SSOe EU & HD User Guide 81 December 2022

6.

Select your email or enter new email address (twice for confirmation).

SSOe EU & HD User Guide 82 December 2022

7.

Please select the reason for replacement.

Click ‘Continue’

SSOe EU & HD User Guide 83 December 2022

8.

Please review the confirmation screen, and if the information is not accurate, click ‘Cancel

Request’, otherwise click ‘Submit Request’ to complete your application.

SSOe EU & HD User Guide 84 December 2022

9.

Successful card request.

Checking status of VHIC

SSOe EU & HD User Guide 85 December 2022

1.

After submitting request, if you wish to check status, login to VHIC-SS at a later date and your current status will display.

Log out from Active SSOe Session

Depending on the application, logging out from it may completely close the SSOe session or return you to the AccessVA Authenticated Home Page, where you can elect to access another application or log completely out of the active SSOe session. Take the following steps to close the SSOe session from the AccessVA Authenticated Home Page.

SSOe EU & HD User Guide 86 December 2022

Table 26: Log Out from Active SSOe Session

Step Action

1. Log out of the application.

2. On the Authenticated AccessVA Home Page, click the Logout button.

5. Troubleshooting

FAQs

SSOe EU & HD User Guide 87 December 2022

Table 27: SSOe FAQs

Question Answer

What is a Level of Assurance? The National Institute of Standards and Technology (NIST) defined four separate levels of assurance: Assurance Level 1 through Assurance Level

4. The higher the level, the higher the confidence that you are who you say you are. Assurance Level 2 is needed to access many important features of

VA participating applications. Level 3 and Level 4 require additional technology in addition to a simple user ID and password to provide the additional level of confidence that meet highly secure application requirements.

For more details, see NIST Special Publication 800-63-2, "Electronic

Authentication Guideline," available at:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-

2.pdf

What is Identity Assurance Level

(IAL)?

This refers to the identity proofing process, or how an organization can vet a person’s real life identity against their digital identity.

For more detail on IAL, refer to NIST Special publication 800-63-3, “Digital Identity Guidline” available at : https://pages.nist.gov/800-63-3/

Summary information can ve viewed in “Key Updates to NIST’s Digital

Identity Guidelines:SP 800-63-3” (Tru T. Pham) :

https://duo.com/decipher/key-updates-to-nists-digital-identity-guidelines-sp-800-63-3

What is Authenticator Assurance

Level (AAL)?

This refers to the authentication process, including how additional factors

(multi-factor authentication) can impact risk mitigation.

For more detail on AAL, refer to NIST Special publication 800-63-3, “Digital Identity Guidline” available at : https://pages.nist.gov/800-63-3/

Summary information can ve viewed in “Key Updates to NIST’s Digital

Identity Guidelines:SP 800-63-3” (Tru T. Pham) :

https://duo.com/decipher/key-updates-to-nists-digital-identity-guidelines-sp-800-63-3

What is Federation Assurance

Level (FAL)?

This refers to the assertion used in a federated environment to communicate authentication and attribute information to a relying party.

Federation is what happens when identities cross from one…