1. Externalizing Authentication
Federal ICAM Day
June 18, 2013

2. Panel Participants
Phil Wenger, OMB
Douglas Glair, USPS
Anil John, GSA (Moderator)

3. Phil Wenger, OMB

4. ICAM Information Sharing Day and Vendor Expo
Externalizing Authentication using MAX Authentication as a Service (AaaS) Phil Wenger, OMB
June 2013

5. Key Takeaways Understand the MAX Ecosystem
Understand how Agencies can externalize authentication using MAX’s Shared Credentialing, Provisioning, Authentication, and Authorization and Services

6. MAX.gov - A Complete Cloud Services Platform
Enabling the “Shared First” and “Cloud First” eGov Policies
Identity Management & SSO
Collaboration
Analytics
Data Collections & Surveys
Web Meetings
Remote Desktops for Telework
Federated Search
Wiki & Web Content
Document Management
Social Networking & Publishing
Government-wide Directory

7. MAX AaaS provides Government-wide ID
Plus state, local, international, & non-governmental partner users
Inter-agency
Government-to-Government
Intra-agency
Policymaking, Management and Budget class of activities
State, Local, International, and Non-Governmental Partners
The Public
Available for use by agencies for both cross-government and intra-agency activities
User accounts available for interactions with non-governmental partners in secure Enclaves

8. What MAX AaaS Provides to Agencies
Allow citizen access to agency websites using NSTIC or anonymous logins while enforcing admin access via MAX ID
Use government-wide organic and organizational MAX groups for role-based access control and fine-grained permissions
Immediate Government-wide Identity
Use MAX PIV validation service to meet eGov policies (OMB M-11-11, M-10-28)
Use MAX PIV to SAML gateway service to map 2-factor identity to agency logins or MAX ID
Rapid HSPD-12, DOD CAC PIV Implementation
Federate MAX Authentication with your Agency’s Active Directory
Federate MAX Authentication with SAML 2.0 Single Sign-on (SSO)
Federation and Multi-Agency Single Sign-on

9. MAX AaaS Solution Benefits
Instant Deployment
Cloud based, C&A’d
FIPS 199 FISMA Moderate
Mission-critical use
Low Total Cost of Ownership
No new software to build or license
Self-service delegated administration
Eases management burden
Dual authentication
Augments existing identities
Government-wide Directory
Automatically Maintained

10. MAX AaaS - Scope 120+ Agencie s 300+ Bureaus 85,000+ users
Auto Registration for .gov, .mil and other domains
Agencie s Bureaus
85,000+ users
6,000+ user groups
Thousands of HSPD-12 users from 90+ agencies
Federal, State, Local, International, and Non-government partner users

11. MAX AaaS – Multiple Login Methods
Web Services that support HSPD-12 and ICAM SAML 2.0 Web Browser SSO Profile
Choose between single-factor, dual-factor, or federated login
PIV validation and mapping service
Full path building, validation, revocation checking
Identity data extraction and normalization
Can be mapped to your agency ID
Federate your agency Active Directory or SAML 2.0 instances

12. How Agencies have Externalized Authentication using MAX AaaS Today
MAX ID
MAX Apps
Other Apps
eGov Apps
Agency Apps
MAX A11, Apportionment
BFEM
Adobe Connect
Online Meetings
Wordpress
Drupal
Active Directory
DOJ CyberScope
IT Dashboard, Data.Gov, Performance.Gov

13. MAX Authentication as a Service (AaaS)
Sponsored by the Budget Formulation and Execution Line of Business (BFELoB)
BFELoB Organization and Contacts:
Executive Sponsor: Courtney Timberlake, Assistant Dir. for Budget, OMB
Managing Partner: Tom Skelly, Director of Budget Service, Education
Policy Lead: Andy Schoenbach, Chief, Budget Systems Branch, OMB
Deputy Policy Lead: Phil Wenger, Budget Systems Branch, OMB
Program Management Office Lead: Mark Dronfield, Education
MAX Authentication Lead: Barry Napear, Budget Systems Branch, OMB
MAX Architect: Shahid Shah, Budget Systems Branch (CTR), OMB
Learn More about the Budget LoB: Visit MAX.gov:
Contact the Budget LoB: Contact MAX Support:

14. Background Slides

15. MAX AaaS: Full featured identity services
Self-Service Provisioning
Common Identity, Profile, and Directory
Self service registration and account management
Auto-provisioning for .gov, .mil, etc.
Identity assurance for Levels 2 and 3
Multi-factor Authentication
Single factor (user/password)
Multi factor (PIV/PIV-I/CAC)
Federated (SAML2, ADFS)
Machine2Machine (M2M)
Delegated Authorization
Group Management
Role Management
Delegated Administration
SAML

16. Self Service User Provisioning Process
Less than 5 minutes to get an account for “trusted domains”
Agency user and his/her management defines need to access MAX (employee, contactor, partner)
User self registers on line at MAX portal gov
MAX checks sponsor requirement for outside users
MAX validates user’s address
confirmation sent to user
User accepts MAX User Agreement

17. Self or Managed Authorization Process
MAX notifies user and application administrators
MAX or delegated admin reviews access requests
User applies for application access via MAX portal
MAX assigns user to groups, communities and/or applications as authorized by user’s management
User and his/her management defines MAX application and role to access

18. MAX Identity Management (IDM) Services
Provides APIs for MAX Identities, Profiles, Groups, and Authorization data
AaaS
JSON based RESTful Web Services
IDM
Enhanced

19. MAX PIV Validation (PV) Services
Provides APIs for PIV/PIV-I/CAC validation and identity data extraction
“Public” service available:
Full Path Building, Validation, Revocation Checking
Identity Data Extraction / Normalization PV
PKIF: The PKI Framework

20. MAX PIV-to-SAML Translation Services
Performs PIV validation, maps to MAX ID, then translates to SAML
Apps do not need to be aware of PIV validation details (they are given assurance level as part of SAML assertion)
Perform MAX PIV Validation
Map to MAX ID
Translate to SAML
Pass Assertion to App

21. Agency AD/LDAP Integration (Federation)
Supports ICAM SAML 2.0 Web Browser SSO Profile

22. MAX HSPD-12 Authentication Process
HSPD-12 Certificate 1 4
Internet 2 3
SSL/TLS
Apache Proxy
User connects to MAX and receives Login Page
User enters user/pass or inserts HSPD-12 card into reader and selects PIV login
For HSPD-12 login, browser establishes a TLS connection to Proxy, and Proxy requests a certificate
Browser extracts certificate from card and forwards it to Proxy
Proxy forwards certificate to CAS
CAS matches certificate against Identities Directory
CAS extracts MAX ID and user profile information and prepares a SAML assertion
CAS "forwards" the SAML assertion to the application requesting authentication (no certificates are exchanged) 5
Apps 7
Identities Directory 6 8
Authenticate

23. Douglas Glair, USPS

24. Federal Cloud Credential Exchange (FCCX)
Doug Glair – Manager, Digital Partnerships and Alliances – United States Postal Service

25. Requires IDPs to integrate with multiple Agencies
Federal Cloud Credential Exchange (FCCX) enables the NSTIC and ICAM vision of interoperable credential usage by allowing agencies to securely interact with a single “broker” to facilitate the authentication of consumers
Market Problem
(Government)
The Solution
(FCCX)
Requires Agencies to integrate with multiple Identity Service Providers (IDPs)
Requires IDPs to integrate with multiple Agencies
Creates a single interface between Agencies and IDPs
Speeds up integration
Reduces costs and complexity

26. NIST Levels of Assurance (LOA)
FCCX will integrate with ICAM approved IDPs across the Levels of Assurance (LOA) defined by NIST and approved via the ICAM Trust Framework Solutions
Very high confidence in asserted identity
Approved IdPs:
PIV/ PIV-I Cards
LOA 4
High confidence in asserted identity
Approved IdPs:
Symantec, Verizon
LOA 3
Some confidence in asserted identity
Approved IdPs:
Symantec, Verizon, Virginia Tech
LOA 2
Little or no confidence in asserted identity – self- assertion
Approved IdPs:
Equifax, Google, PayPal, Symantec, VeriSign, Verizon, Wave Systems, Virginia Tech
LOA 1
Complexity & Security

27. FCCX Anticipated User Experience Flow