NAVSUP NDP Hybrid Requirementsv9.pdf

NAVSUP BSC NDP IDM Requirements

Version 9

NiDM Application Rationalization Requirements – Government Use Only

1 Introduction

The NAVSUP Navy Data Platform (NDP) currently has 15,000+ users, around 1,600

Entitlements and Roles, and 2 environment user interfaces (Production and Preproduction).

NDP currently has local Public Key Infrastructure (PKI) Authentication, Identity and Access

Management system that provisions access to these target systems:

• SAP Business Objects (BOBJ)

• SAS Data and AI Solutions

• YellowBrick (YB) Data Warehouse

1.1 Objective

The NDP division is in the process of moving to a government global federated Naval Identity

Services (NIS) system that provides PKI Authentication, Identity, Credential Provisioning and

Access Management (ICAM). However, some of the custom NDP system interfaces cannot be integrated into the NIS ICAM solution, particularly the Yellowbrick (YB) system. The NAVSUP

BSC Identity Management Team is currently researching an additional hybrid ICAM solution that can integrate and provision to the custom NDP target systems.

1.2 Acceptance Criteria:

• The ICAM solution supports Single Sign On (SSO) PKI Authentication to Product Uniform Resource Locator (URL) (no Password login)

• Provides provisioning for granting Data Entitlements

• Provides provisioning for revocation of Data Entitlements

• Provides provisioning for granting Roles or Groups for applications and data

• Provides provisioning for creating NDP Accounts

• Provisioning for revocation of NDP Accounts

• The new ICAM solution must interface with all active NDP target systems

• The new ICAM solution must interface with the federated NIS systems to pull user data.

• Visible/Auditable tracking of User Requests

• Privileged Users can request entitlements for multiple users at the same time

• Approvers can approve or reject multiple entitlement requests simultaneously

• The new ICAM solution must support the Identity Connector Framework (ICF)

• New ICAM Solution must provide a service interface to execute provisioning functions outside of the web UI (User Interface)

• The new ICAM Solution must support zero trust.

• The new ICAM Solution must be FedRAMP approved.

2 PKI Authentication and Access Control

2.1 PKI Authentication and Access Considerations:

• Utilizes a remote federated PKI Authentication method

• Provides either Security Access Markup Language (SAML) or OAuth Support, with SSO for existing third-party applications

2.2 PKI Authentication

The product ICAM solution will need to support external SSO Authentication mechanism. All NDP websites will PKI authenticate the user certificate to NIS global Navy Enterprise Identity provider (IdP).

2.3 PKI Certificate Expiration and User Life Cycle

We need to be able to disable the users in the NDP system, either manually or through an automated process. When a Common Access Card (CAC) Certificate expires or is revoked, it needs to automatically disable account access within 24 hours in the NDP target systems.

3 NDP User Provisioning

3.1 User Provisioning Considerations:

• Requests must be manageable for both the Approvers and Identity Management (IDM)

Admins

• Email notifications for provisioning tasks such as entitlement/role requests are supported

• Ability to associate NDP Users with an NDP Home Organization is required.

• Privileged Users/Managers can submit a Request for Others

• The solution must provide the ability to attach documents for approvals and requests

• Must support automated workflow approval process

• Must provide the ability to manage users in various approver roles

3.2 NDP Home Organizations

Users who access NDP system resources require a NDP participating mission partner Home Organization. The Home Organization bears the responsibility of approving access and mapping to data. NAVSUP prefers this to be provided as an attribute on the user record.

3.3 User Provisioning Role Permissions

• The tool must support privileged, non-privileged, and administrator (Identity and Access

Management Admin (IdAM) roles.

Normal NDP Viewer User – Self Service role that does not require any privilege access in order to request provisioning for themselves.

NDP OrgAdmin User – Self Service privilege role that allows NDP users to create Schemas, object and reports in the NDP target systems. It also requires the users to manage their own passwords.

Request for Others (RFO) – A privilege role allowing users to View Other Users account data, Request Provisioning for another user, Request Revoke Provisioning for another user.

Adhoc User – A role allowing PDA Viewers users to manage their own passwords.

4 NDP Provisioning Interfaces

4.1 Provisioning Interface Considerations

• The product must support customizable connectors that can integrate various Software

Development Kit (SDKs) from other products.

• Data need to be pushed out to NDP target systems.

NAVSUP BSC will provide the following SDKs:

• SAS Provided Software Development Kit Application Programming Interface (SDK API).

• BOBJ Provided SDK.

• YellowBrick Data Warehouse requires a PostgreSQL driver.

4.2 Current Provisioning Connector Framework

The vendor ICAM solution must support Identity Connector Framework (ICF) Java standard. A connector server was implemented in NAVSUP Cloud environment that already has three Java custom connectors for provisioning to NDP target systems. The NDP target systems are:

• SAP Business Objects (BOBJ)

• SAS Data and AI Solutions

• YellowBrick Data Warehouse

The three NDP target system custom connectors implement a product provided SDK APIs to interface into the NDP target system listed above.

4.3 Provisioning Operations for NDP Target systems

The solution must contain the following provisioning operations/functions within each interface that are used to update the NDP Target system:

• Enable User

• Disable User

• Grant Entitlement

• Revoke Entitlement

• Create User

• Delete User

• Update User (also used for reset password)

5 Request profiles

Request profiles allow users to select multiple entitlements in one single transaction.

5.1 Request Profile Considerations:

o Admins require the capability to create/delete/edit request profiles in the ICAM solution o Multiple entitlements will be assigned to each request profile

6 Request and Approval Workflows

6.1 Approval Request Workflows Considerations:

• Must support custom workflow business logic development.

• The ICAM solution must support the following NDP dynamic routing rules:

o Entitlements require a specific approver role to be associated. It must route to that approver role.

o Email Notifications are sent to approvers and Beneficiaries.

o The ICAM solution workflow must incorporate multiple approval stages.

NOTE: An approver will approve or deny a request for an entitlement resource access. The request could be a new entitlement, a modification to an account, or a revocation of an item, as well as any other changes to users or user entitlements or user permissions.

7 Data Sync Reconciliation

7.1 Reconciliation Scheduler Considerations:

• The ICAM product must be able to pull/recon existing user data from the target system into ICAM system.

• The new ICAM system must be able to check if a user is disabled/deactivated in a target system.

8 Entitlement and Role Bulk Loading and Bulk Removing

The new system must be capable of efficiently granting entitlements to a large number of users simultaneously.

8.1 Entitlement and Role Bulk Loading/Removing Considerations:

• Must provide capability to bulk load and bulk remove NDP target entitlements for user accounts in the target systems.

• If there is an error with provisioning the entitlement, the product must log the error and move onto the next user.

9 Ad hoc Reporting

NAVSUP IDM admins must have access to instantly pull customizable user account reports.

9.1 AdHoc Reporting Considerations:

• NAVSUP requires the ability to export reports into a Spreadsheet.

10 Provisioning Error Management

10.1 Provisioning Error Management Considerations:

• Provisioning errors need to be reported in the tool.

• The new system must provide an option or capability to retry failed tasks.

11 Log Auditability

11.1 Log Auditability Considerations:

• Must provide the ability for NAVSUP IDM Admins to view and export audits logs of our

NDP users o Auditability for provisioning users with specific timestamps

12 Performance

The system must be able to support 15,000+ users without latency. The solution should provide a monthly report outlining the system’s performance and uptime, including any outages, incidents, and corresponding resolution times.

To ensure optimal efficiency, the platform must meet the following performance requirements:

1. Request Routing for Approvals: All user-initiated access requests must be routed to the designated approver within 2 minutes of submission. Requests that cascade to subsequent approvers must cascade to subsequent approvers immediately after the preceding approval.

2. Provisioning Entitlements Fulfillment: Once an access request is approved, provisioning must begin within 5 minutes.

3. Password Resets: Password reset requests from the global federated NIS system, must be processed within 30 seconds for automated workflows.

13 Licensing

13.1 Licensing Considerations:

The Vendor shall provide a comprehensive description of their licensing model, including all associated costs. This description must include details on the costs for ongoing maintenance and support, encompassing bug fixes, security updates, and technical assistance. These costs must be incorporated into the licensing fee.

13.2 Cost Breakdown

Vendor proposals should provide a cost breakdown for:

• System design, development, and implementation

• Integration with existing systems/applications

• Training and documentation

• Testing and quality assurance

• Deployment to production

• Initial post-launch support

• Ongoing support and maintenance

• Optional features or add-ons

14 Conclusion

The transition from the current system to the new ICAM system must enhance our identity and access management capabilities. By meeting the outlined functional and non-functional requirements, mitigating identified risks, and leveraging the benefits of the new platform, this migration will support our organization’s long-term goals.