Attachment A - KOG Integration Version 2.1.7.docx

Title: Attachment R – KOG Integration Version: 2.1.7

Commonwealth of Kentucky

Kentucky Online Gateway

(KOG) Integration

Attachment R - KOG Integration

KOG Integration

The Kentucky Online Gateway (KOG) is the Cabinet for Health and Family Services’ (CHFS) enterprise identity and access management system and web Single Sign-On (SSO) platform. KOG is to be leveraged for SSO for all new business applications including both authentication and authorization for users based on claims. Currently KOG primarily uses Active Directory and ForgeRock as IDaaS platform (Identity as a Service Provider).

A. Integration Requirements and Supported Authentication Protocols Integration with KOG is mandatory for all applications. To ensure seamless integration with KOG and adherence to authentication and authorization standards, business applications must be claims-aware. A claim is a declaration made by an entity (e.g., name, identity, group, privilege, attribute, etc.). Applications integrating with KOG must be able to integrate with ForgeRock’s Security Token Service using one of the following protocols:

1. SAML 2.0; or

2. OIDC / OAuth 2.0; or

3. WS-Fed (least preferred)

KOG team constantly reviews current security trends, features / functionalities it supports and may update the platform in future. KOG will try to make sure to have minimal impact on client applications and users but as a part of platform update, client applications may have to make changes on their side to point / integrate with new platform.

The below section will discuss the fundamental architecture, technology standards, and implementation options for applications integrating with KOG.

A.1 SSO / SLO, Authentication, Authorization and User Provisioning

1. Applications will interface with KOG through ForgeRock for SSO / SLO. All applications MUST support / participate in single sign-on (SSO) and single logout (SLO) processes using respective protocol.

2. New applications integrating with KOG must be compliant with either SAML 2.0 or OIDC / OAuth 2.0 or WS-Fed; and use Claims for user authentication and authorization.

3. Application access will be handled through the integration with KOG.

4. Authorized users will have access to all of their applications from the KOG dashboard via either static or dynamic widgets / tiles.

A.2 Security Roles

1. User roles will be defined by the consuming application. The application will determine which functions and data elements are available for each user role and is responsible for implementing / enforcing the functions and permissions of each user role within the application.

2. Users will be assigned user roles in KOG using the KOG interfaces for requesting and assigning user roles. A user’s assigned user role(s) will be communicated to the consuming application using Claims.

A.3 User Store

1. KOG will retain ownership of all user accounts and user profile data including entitlements for registered users.

2. Applications will need to read user profile information and authorizations / roles from SAML (in case of SAML or WS-Fed) or JWT (in case of OIDC / OAuth 2.0) claims.

3. KOG also supports secure (HTTPS) JSON based web APIs that client applications can call (out of band) to retrieve user profile information and authorizations.

4. Applications must consume and store the user KOG ID to uniquely identify each user coming from KOG. User KOG ID is a static GUID used to identify a unique user in KOG.

B. Deployments and Environment Mappings New applications will be responsible for all aspects of solution environment integration with KOG including:

1. Detailed design documentation;

2. Mapping and integration of application environments to KOG environments (Integrated Dev, Test, UAT, Training, Production);

3. Integration testing;

4. End-to-end testing of all API(s); and

5. Performance testing.

As part of the integration efforts, new applications will also be responsible for providing configuration items including:

1. Integration documentation;

2. Federation metadata;

3. Requirements for any claims that will be passed in the SAML / JWT token;

4. List of application roles;

5. Workflow for each role, if required (i.e., approvers); and

6. Information needed via API must be prescribed.

C. Vendor Responsibilities for Providing Technical Resources The application owner or application vendor shall be responsible for performing all necessary JAD sessions to complete the design of all security requirements, requirements for integrating the solution into the respective KOG environments, and any development/customizations required by the solutions outside of in-built KOG functionality. The vendor shall be responsible for providing adequate technical resources that have working knowledge in implementing the respective SSO protocol (whichever is applicable) on the client application side. For example, if the application is going to use the SAML 2.0 protocol, then the technical resources working on the KOG integration from the client application perspective should have working knowledge of how the SAML protocol works in a SSO and SLO scenarios and should be able to sign and send SAML authentication requests, logout response and should be able to validate and consume SAML assertions, logout requests being sent from ForgeRock.

D. Core KOG Functionality for Internal Users Below is an overview of the core KOG features and functionality that are available to internal users of integrated business applications:

1. Application Management – Application-specific configuration in KOG and ForgeRock.

2. Account Management – All internal users must have an account on the existing COT-managed Active Directory and defined in KOG.

3. Role Management – Each solution shall be defined as an application in KOG and ForgeRock, and any necessary security role types shall be configured and managed in KOG.

4. Internal User Account Management – KOG will handle all user account management. This functionality includes assigning, modifying and revocation of user access to each application within KOG. All internal users shall be managed via KOG in order to have access to a specific role for each solution.

5. User/Usage Agreements – Enterprise and departmental user/usage agreements and user responses to such agreements shall be stored and maintained in KOG.

6. Single Sign-On and Single Logout – All on-boarding applications must participate in the KOG Single Sign-on solution, which will provide access to all solutions via KOG / ForgeRock without requiring the user to sign on to individual applications explicitly. All on-boarding applications must also participate in standard protocol based single logout (SAML 2.0 or OIDC (back-channel) etc.) to make sure that users will be able to logout not only from KOG but also from all signed in applications within SSO session.

7. Multi-Factor Authentication – KOG utilizes different authentication frameworks to implement enhanced security, for applications that require multi-factor, KOG offers ForgeRock Authenticator, Symantec VIP, SMS/text, voice calls and email based codes for users.

D.1 Additional KOG Functionality for External Users

1. Self-Service Account Creation – Citizen user registration shall occur via KOG. The process shall require the requesting user to provide their First Name, Last Name, answers to two user-selected security questions, and an active e-mail address in order to submit and complete e-mail verification process.

2. Self-Service Access Request – Following user registration, KOG provides the user with the ability to request access to an application through an app store-styled dashboard.

3. Remote Identity Proofing – Depending upon requirements user may be asked to go through remote identity proofing as a part of access request process.

4. Password Management – During user registration the user shall be required to provide a password. KOG password management includes current industry security standards.

E. Vendor Responsibilities for KOG Security

1. Work with the CHFS security team and KOG team to facilitate JAD sessions necessary to identify and design all aspects of the solutions necessary to assure a seamless integration with KOG.

2. Coordinate, communicate, and facilitate business and technical JAD sessions in order for the vendor to design and develop all security roles and validation requirements and any required additional components to assure robust security for all solutions.

3. Applications integrating with KOG shall be designed as ForgeRock/OIDC/OAuth2.0/SAML 2.0 compliant. In case of SAML integration, KOG needs client applications to use public CA-issued certificates to use for SAML signing and encryption purposes in all environments (non-production and production). The Vendor shall work with the CHFS security and KOG team to define custom claim data necessary for secure access to the solutions.

4. Design, develop, test, and implement all solutions functionality required to assure access to information is restricted by security role and custom claim data, and any required additional security components necessary for successful implementation of the solutions.

5. Design and develop all solutions to be claims aware and participate in single sign-on and single logout.

6. Design and develop all solutions to utilize role-based security

7. Provide necessary information for the initial onboarding of users to new solutions, which shall include, but not be limited to, working with the CHFS Security team and KOG team to compile, provide data mapping including initial user provisioning for all existing / new users.

8. Design, integrate, test, and map solution environments with the KOG environments including performance testing.

9. Vendor’s business applications must adhere to current KOG functionality whenever possible.

image1.jpg