Attachment I - KOG Integration.pdf

KOG Integration – 12/27/19 The Commonwealth of Kentucky 1

KOG Integration

The Kentucky Online Gateway (KOG) is the Commonwealth of Kentucky’s enterprise identity and access management system and web Single Sign-On (SSO) platform. KOG is to be leveraged for SSO for all new business applications including both authentication and authorization for users based on claims. KOG is built using the following technologies: Microsoft .Net 4.7.1 Framework, SQL Server 2016, Active Directory, and Active Directory Federation Services 5.0.

A. Integration Requirements and Supported Authentication Protocols A claim is a declaration made by an entity (e.g., name, identity, group, privilege, attribute, etc).

Business Applications integrating with KOG must be claims-aware and integrate with KOG’s Security Token Service using one of the following protocols:

1. WS-Federation;

2. SAML 2.0; or

3. OpenID and OAuth2.

The below section will discuss the fundamental architecture, technology standards, and implementation options for applications integrating with KOG:

A.1 SSO, Authentication and User Provisioning

1. Applications will interface with KOG through ADFS for SSO;

2. New applications integrating with KOG must be compliant with either ADFS, WS Federation, SAML 2.0, or OpenID and OAuth2, and use Claims for Authentication and Authorization;

3. KOG supports both active (WS-Trust) and passive (WS-Federation and SAML 2.0, OpenID and

OAuth2) scenarios;

4. Application access will be handled through the integration with KOG; and

5. Authorized users will have access to all of their Applications from the KOG Dashboard via either static or dynamic widgets.

A.2 Security Roles User Roles will be defined by the Consuming Application. The Application will determine which functions and data elements are available for each User Role and is responsible for implementing the functions and permissions of each User Role within the application. Users will be assigned User Roles in KOG using the KOG interfaces for requesting and assigning User Roles. A user’s assigned User Role(s) will be communicated to the Consuming Application using the Claims.

A.3 User Store

1. KOG will retain ownership of all user accounts and user profile data including entitlements for registered users;

2. Applications will need to read profile information from SAML claims or integrate with KOG APIs in order to retrieve profile information and entitlements;

The Commonwealth of Kentucky 2

3. Applications will make API calls directly to KOG through secure (HTTPS), SOAP-based web services;

4. APIs will be utilized for user profile queries, retrieving application user agreements, credentialing, etc.; and

5. Applications will consume and store the KOG ID for authentication, which is a static GUID used to identify a unique user in KOG.

B. Deployments and Environment Mappings New Applications will be responsible for all aspects of solution environment integration with KOG including:

1. Design Documentation;

2. Mapping and integration of application environments to KOG environments (Integrated Dev, Test, UAT, Training, Production);

3. Integration testing;

4. End-to-end testing of all API(s); and

5. Performance testing.

As part of the integration efforts, new Applications will also be responsible for providing configuration items including:

1. Integration Documentation;

2. Federation Metadata;

3. Requirements for any claims that will be passed in the SAML token;

4. List of Application Roles;

5. Workflow for each role, if required (i.e., approvers and credentials); and

6. Information needed via API must be prescribed.

C. Vendor Responsibilities for Providing Technical Resources The Application Owner or Application Vendor shall be responsible for performing all necessary JAD sessions to complete the design of all security requirements, requirements for integrating the solution into the respective KOG environments and any development/customizations required by the solutions outside of inbuilt KOG functionality. The Vendor shall be responsible for providing adequate technical resources that have working knowledge in implementing the respective SSO protocol (whichever is applicable) on the client application side. For example, if the Application is going to use the SAML 2.0 protocol, then the technical resources working on the KOG integration from the client application perspective should have working knowledge of how the SAML protocol works in a SSO scenario and should be able to sign and send SAML authentication requests, SAML logout requests and logout responses, and should be able to validate and consume SAML assertions being sent from ADFS.

D. Core KOG Functionality for Internal Users Below is an overview of the core KOG features and functionality that are available to internal users of integrated business applications:

The Commonwealth of Kentucky 3

1. Application Management – Application-specific configuration in KOG.

2. Account Management – All internal users must have an account on the existing

Commonwealth Office of Technology (COT)-managed Active Directory and defined in KOG.

3. Role Management – Each solution shall be defined as an application in KOG, and any necessary security role types shall be configured and managed in KOG. This information shall be passed to the solution.

4. Internal User Account Management – KOG will handle all user account management. This functionality includes creating, updating, and terminating users and user access to each application within KOG. All internal users shall be managed via KOG in order to have access to a specific role for each solution.

5. User/Usage Agreements – Enterprise and Departmental User/Usage Agreements and user responses to such agreements shall be stored and maintained in KOG. Solutions must acquire an agreement from KOG via a Web Service API in order to display the agreement to the user and must return the user response to KOG for storage.

6. Single Sign-On – All on-boarding Applications must participate in the KOG SSO solution, which will provide access to all solutions via the KOG landing-page without requiring the user to sign on to any of these Applications and/or launching the application from each Application’s web page. All Application access will be initiated from the KOG landing page.

7. Multi-Factor Authentication – KOG utilizes different frameworks to implement enhanced security. For applications that require Multi-Factor Authentication we utilize Symantec’s services and their VIP Access clients, email, and SMS text for users.

D.1 Additional KOG Functionality for External Users

1. Self-Service Account Creation – Citizen User Registration shall occur via KOG. The process shall require the requesting user to provide an e-mail address, answer two security questions, and submit an e-mail verification response.

2. Self-Service Access Request – Following User Registration, KOG provides the user with the ability to request access to an application through an app store-styled dashboard.

3. Credential Validation and Management – During the request for access, the user shall be required to enter various credentialing and non-credentialing information. This information shall be made available to the user and may be updated at user request.

4. Password Management – During User Registration the user shall be required to provide a password. KOG password management includes current industry security standards as they relate to challenge questions and responses, user profile updates, and account and password resets.

E. Vendor Responsibilities for KOG Security

1. Work with the COT Security Team and facilitate JAD sessions necessary to identify and design all aspects of the solutions necessary to assure a seamless integration of all solutions with KOG;

2. Coordinate, communicate, and facilitate business and technical JAD sessions in order for the vendor to design and develop all security roles, credential types, and validation requirements, and any required additional components to assure robust security for all solutions;

3. Applications integrating with KOG shall be designed as ADFS/WS-Federation/SAML 2.0/OpenID-and OAuth2-compliant. In case of SAML integration, KOG needs client Applications to use Public

The Commonwealth of Kentucky 4

CA-issued certificates to use for SAML signing and encryption purposes in all environments (non-production and production). The Vendor shall work with the Commonwealth Security Team to define custom claim data necessary for secure access to the solutions;

4. Design, develop, test, and implement all solution functionality required to validate credentials, pass validation and user agreement information back to KOG, assure access to information is restricted by security role and custom claim data, and any required additional security components necessary for successful implementation of the solutions;

5. Design and develop all solutions to be claims aware and participate in SSO;

6. Design and develop all solutions to utilize role-based security;

7. Provide work necessary for the initial onboarding of users to the new solutions, which shall include, but not be limited to, working with the COT Security Team to compile and provide data mapping including initial User Provisioning information via KOG for all existing internal users;

8. Design, map, integrate, and test solution environments with the KOG environment including performance testing; and

9. Vendor’s business applications must adhere to current functionality whenever possible.

F. Commonwealth Responsibilities for KOG Security

1. The Commonwealth will participate in meetings and JAD sessions as necessary; and

2. The Commonwealth will assure all relevant modifications to KOG are made.