Presentation is loading. Please wait.

Presentation is loading. Please wait.

Externalizing Authentication

Similar presentations

Presentation on theme: "Externalizing Authentication"— Presentation transcript:

1 Externalizing Authentication
Federal ICAM Day June 18, 2013

2 Panel Participants Phil Wenger, OMB Douglas Glair, USPS Anil John, GSA (Moderator)

3 Phil Wenger, OMB

4 ICAM Information Sharing Day and Vendor Expo
Externalizing Authentication using MAX Authentication as a Service (AaaS) Phil Wenger, OMB June 2013

5 Key Takeaways Understand the MAX Ecosystem
Understand how Agencies can externalize authentication using MAX’s Shared Credentialing, Provisioning, Authentication, and Authorization and Services

6 - A Complete Cloud Services Platform
Enabling the “Shared First” and “Cloud First” eGov Policies Identity Management & SSO Collaboration Analytics Data Collections & Surveys Web Meetings Remote Desktops for Telework Federated Search Wiki & Web Content Document Management Social Networking & Publishing Government-wide Directory

7 MAX AaaS provides Government-wide ID
Plus state, local, international, & non-governmental partner users Inter-agency Government-to-Government Intra-agency Policymaking, Management and Budget class of activities State, Local, International, and Non-Governmental Partners The Public Available for use by agencies for both cross-government and intra-agency activities User accounts available for interactions with non-governmental partners in secure Enclaves

8 What MAX AaaS Provides to Agencies
Allow citizen access to agency websites using NSTIC or anonymous logins while enforcing admin access via MAX ID Use government-wide organic and organizational MAX groups for role-based access control and fine-grained permissions Immediate Government-wide Identity Use MAX PIV validation service to meet eGov policies (OMB M-11-11, M-10-28) Use MAX PIV to SAML gateway service to map 2-factor identity to agency logins or MAX ID Rapid HSPD-12, DOD CAC PIV Implementation Federate MAX Authentication with your Agency’s Active Directory Federate MAX Authentication with SAML 2.0 Single Sign-on (SSO) Federation and Multi-Agency Single Sign-on

9 MAX AaaS Solution Benefits
Instant Deployment Cloud based, C&A’d FIPS 199 FISMA Moderate Mission-critical use Low Total Cost of Ownership No new software to build or license Self-service delegated administration Eases management burden Dual authentication Augments existing identities Government-wide Directory Automatically Maintained

10 MAX AaaS - Scope 120+ Agencie s 300+ Bureaus 85,000+ users
Auto Registration for .gov, .mil and other domains Agencie s Bureaus 85,000+ users 6,000+ user groups Thousands of HSPD-12 users from 90+ agencies Federal, State, Local, International, and Non-government partner users

11 MAX AaaS – Multiple Login Methods
Web Services that support HSPD-12 and ICAM SAML 2.0 Web Browser SSO Profile Choose between single-factor, dual-factor, or federated login PIV validation and mapping service Full path building, validation, revocation checking Identity data extraction and normalization Can be mapped to your agency ID Federate your agency Active Directory or SAML 2.0 instances

12 How Agencies have Externalized Authentication using MAX AaaS Today
MAX ID MAX Apps Other Apps eGov Apps Agency Apps MAX A11, Apportionment BFEM Adobe Connect Online Meetings Wordpress Drupal Active Directory DOJ CyberScope IT Dashboard, Data.Gov, Performance.Gov

13 MAX Authentication as a Service (AaaS)
Sponsored by the Budget Formulation and Execution Line of Business (BFELoB) BFELoB Organization and Contacts: Executive Sponsor: Courtney Timberlake, Assistant Dir. for Budget, OMB Managing Partner: Tom Skelly, Director of Budget Service, Education Policy Lead: Andy Schoenbach, Chief, Budget Systems Branch, OMB Deputy Policy Lead: Phil Wenger, Budget Systems Branch, OMB Program Management Office Lead: Mark Dronfield, Education MAX Authentication Lead: Barry Napear, Budget Systems Branch, OMB MAX Architect: Shahid Shah, Budget Systems Branch (CTR), OMB Learn More about the Budget LoB: Visit Contact the Budget LoB: Contact MAX Support:

14 Background Slides

15 MAX AaaS: Full featured identity services
Self-Service Provisioning Common Identity, Profile, and Directory Self service registration and account management Auto-provisioning for .gov, .mil, etc. Identity assurance for Levels 2 and 3 Multi-factor Authentication Single factor (user/password) Multi factor (PIV/PIV-I/CAC) Federated (SAML2, ADFS) Machine2Machine (M2M) Delegated Authorization Group Management Role Management Delegated Administration SAML

16 Self Service User Provisioning Process
Less than 5 minutes to get an account for “trusted domains” Agency user and his/her management defines need to access MAX (employee, contactor, partner) User self registers on line at MAX portal gov MAX checks sponsor requirement for outside users MAX validates user’s address confirmation sent to user User accepts MAX User Agreement

17 Self or Managed Authorization Process
MAX notifies user and application administrators MAX or delegated admin reviews access requests User applies for application access via MAX portal MAX assigns user to groups, communities and/or applications as authorized by user’s management User and his/her management defines MAX application and role to access

18 MAX Identity Management (IDM) Services
Provides APIs for MAX Identities, Profiles, Groups, and Authorization data AaaS JSON based RESTful Web Services IDM Enhanced

19 MAX PIV Validation (PV) Services
Provides APIs for PIV/PIV-I/CAC validation and identity data extraction “Public” service available: Full Path Building, Validation, Revocation Checking Identity Data Extraction / Normalization PV PKIF: The PKI Framework

20 MAX PIV-to-SAML Translation Services
Performs PIV validation, maps to MAX ID, then translates to SAML Apps do not need to be aware of PIV validation details (they are given assurance level as part of SAML assertion) Perform MAX PIV Validation Map to MAX ID Translate to SAML Pass Assertion to App

21 Agency AD/LDAP Integration (Federation)
Supports ICAM SAML 2.0 Web Browser SSO Profile

22 MAX HSPD-12 Authentication Process
HSPD-12 Certificate 1 4 Internet 2 3 SSL/TLS Apache Proxy User connects to MAX and receives Login Page User enters user/pass or inserts HSPD-12 card into reader and selects PIV login For HSPD-12 login, browser establishes a TLS connection to Proxy, and Proxy requests a certificate Browser extracts certificate from card and forwards it to Proxy Proxy forwards certificate to CAS CAS matches certificate against Identities Directory CAS extracts MAX ID and user profile information and prepares a SAML assertion CAS "forwards" the SAML assertion to the application requesting authentication (no certificates are exchanged) 5 Apps 7 Identities Directory 6 8 Authenticate

23 Douglas Glair, USPS

24 Federal Cloud Credential Exchange (FCCX)
Doug Glair – Manager, Digital Partnerships and Alliances – United States Postal Service

25 Requires IDPs to integrate with multiple Agencies
Federal Cloud Credential Exchange (FCCX) enables the NSTIC and ICAM vision of interoperable credential usage by allowing agencies to securely interact with a single “broker” to facilitate the authentication of consumers Market Problem (Government) The Solution (FCCX) Requires Agencies to integrate with multiple Identity Service Providers (IDPs) Requires IDPs to integrate with multiple Agencies Creates a single interface between Agencies and IDPs Speeds up integration Reduces costs and complexity

26 NIST Levels of Assurance (LOA)
FCCX will integrate with ICAM approved IDPs across the Levels of Assurance (LOA) defined by NIST and approved via the ICAM Trust Framework Solutions Very high confidence in asserted identity Approved IdPs: PIV/ PIV-I Cards LOA 4 High confidence in asserted identity Approved IdPs: Symantec, Verizon LOA 3 Some confidence in asserted identity Approved IdPs: Symantec, Verizon, Virginia Tech LOA 2 Little or no confidence in asserted identity – self- assertion Approved IdPs: Equifax, Google, PayPal, Symantec, VeriSign, Verizon, Wave Systems, Virginia Tech LOA 1 Complexity & Security

27 FCCX Anticipated User Experience Flow


Download ppt "Externalizing Authentication"

Similar presentations

Ads by Google