New Mexico Environment Department The E-Enterprise Integrated Identity Solution Project (ISOL) Mary Montoya, CIO Bogi Malecki, Project Manager Tom McMichael, Systems Analyst Mark Morell, Systems Integrator & Technical Writer Sam Jenkins, Solutions Architect 12/14/2015 Project Certification Committee Presentation

Environment Department Mission The mission of the New Mexico Environment Department is to protect and restore the environment, and to foster a healthy and prosperous New Mexico for present and future generations. 12/14/2015 Project Certification Committee Presentation

Project Purpose Discover & Analyze. Evaluate identity and access management of NM, TN and WY Single Sign-On systems and EPA’s Identity Bridge system and determine the impact of implementing a proposed federated identity solution. 12/14/2015 Project Certification Committee Presentation

Main Goal Identify how best to authenticate users with one site and allow secure access to all other sites without re-authenticating: 12/14/2015 Project Certification Committee Presentation

Ultimate Aim Reduce burden and cost of maintaining multiple identities and systems for transacting business and sharing environmental data across entities. 12/14/2015 Project Certification Committee Presentation

Planned Approaches Use Third Party Identities Enable Single Sign-On using Secure Token Services Integrate OpenID / OpenID Connect Identity Provider Interface 12/14/2015 Project Certification Committee Presentation

1. Use 3rd Party Identities 1. A user tries to access a protected resource at the web site (relying party). 2. The user is offered a choice of identity providers and redirected to the selected identity provider. 3. The user authenticates by providing login information at the identity provider’s login page. 4. After successful authentication, the user is redirected to the relying party web site along with a signed security token and other information (claims). 5. The relying party validates the security token and allows access if the token is valid (it was signed by the trusted issuer). 12/14/2015 Project Certification Committee Presentation

3rd Party Log-in Example Redirect to the Enterprise Security Bridge with Facebook IdP specified User authenticates at Facebook Enterprise Security Bridge redirects to the E-Enterprise Portal E-Enterprise Portal uses Web Services Federation to validate 12/14/2015 Project Certification Committee Presentation

2. Enable Single-Sign On A user attempts to login at an identity provider by presenting user ID and credential. The identity provider validates the user’s claim. It requests the STS to issue a security token if the identity is valid. The STS verifies the identity provider’s credential and signs the security token if the identity provider is trusted. The user ID and other identity information will be encrypted into the token. The identity provider returns the security token to signal a successful login. The user then asks for services at another application (the Relying Party) with the security token as the evidence of an authenticated user (I have logged in already, here is my ticket). The suspicious relying party verifies the claim by validating the security token at the STS. The STS checks the token and returns the user’s ID, along with other attributes, if successful. The relying party performs requested operation and returns results to the user. 12/14/2015 Project Certification Committee Presentation

3. Integrate OpenID 1. User accesses the OpenID Connect application (relying party) 2. The user is redirected to the "authorization endpoint" of CFS (Cloud Federation Service) to authenticate 3. If the user authenticates, she is prompted to authorize the application to access certain profile information 4. The user browser is sent back to the client application (indicated by the Callback URL in the configuration) with the authentication/authorization result. 5. The application can contact CFS at the UserInfo endpoint. The application has a maximum of 2 minutes to contact CFS for the user's information. After 2 minutes, the access token is no longer valid and steps 2-4 shown in the diagram must be done again. Note here that even if steps 2-4 will be executed again, the user will not see any of this because they will already have been authenticated by CFS (and not prompted again) and already authorized the application to access their information (so they won't have to consent again - as long as they have not manually revoked access to this application in the meantime). 6. The UserInfo endpoint (CFS) returns consented profile information to the client application. 12/14/2015 Project Certification Committee Presentation

OpenID Log-in Page Example 12/14/2015 Project Certification Committee Presentation

General Information The project was conceived and initiated by NMED Office of Information Technology The proposal was sent to EPA November, 2014 NMED was awarded funding September, 2015 The funding period is 10/1/2015 – 9/30/2017 The funding budget is $472,737 12/14/2015 Project Certification Committee Presentation

High Level Project Overview Objective Budget Due Date Finalize Scope; Execute Contracts & MOAs; Purchase licenses; Assign team tasks & deadlines $36,856 12/11/2015 Perform Federated Identity Management discovery and a solutions assessment with EPA $25,617 8/26/2016 discovery and a solutions assessment of NM $85,248 10/28/2016 discovery and a solutions assessment of TN $118,182 11/25/2016 discovery and a solutions assessment of WY $117,364 12/23/2016 Analyze results, compile and submit findings & recommendations $63,720 4/1/2017 Closeout $25,750 5/31/2017 Total $472,737   The different cell colors indicate different project phases. 12/14/2015 Project Certification Committee Presentation

Stakeholders and Governance EPA - Office of Environmental Information (OEI) Exchange Network Leadership Council (ENLC) Exchange Network Technology Board (NTB) NMED Office of Information Technology - Office of the CIO Tennessee Department of Environment and Conservation Wyoming Department of Environmental Quality NM Department of Information Technology – Project Certification Committee 12/14/2015 Project Certification Committee Presentation

Project Management Plan Present to PCC at Initiation & Planning phase Submit Quality Assurance Plan to EPA Submit semi-annual progress reports to EPA Present bi-monthly status reports to ENLC Present monthly reports to PCC Hold monthly meetings with partner states to track progress and findings Weekly project team meetings to check task status, identify roadblocks & assess schedule impact Present to PCC at Implementation phase Present to PCC at Closeout project phase Submit final report to EPA 12/14/2015 Project Certification Committee Presentation

Risks & Issues Possible risks include: Insufficient participation from partner states/EPA Inconsistent statutory requirements across jurisdictions EPA imposed technologies and/or requirements that are inconsistent with the project goals 12/14/2015 Project Certification Committee Presentation

Questions 12/14/2015 Project Certification Committee Presentation