1. GC Credential Management Evolution for the OASIS/World Bank eGov Workshop 17 th April, 2009For information, please contact: Bob.Sunday@pwgsc.gc.ca

2. 2 Typical GOL Services Canada Site Gateways Clusters EI on the Web Census 2006 (surveys..) E-consultation Dep’t web sites(info) Tax Filing Online My Tax Account Business Tax Account Record of Employment Address Change Interactive Info Service GC Employee Services Passport On-line Secure Channel: The Enabler for Government On-Line Citizens Businesses Visitors Federal Provincial Municipal Business

3. 3 Issued epass Certificates (since Sept 2002)

4. 4

5. 5 So why does GC need to change? $$$$  Decentralized funding  Expense of PKI  Custom GC code Risk based Assurance Model Multi-jurisdiction environment  Provincial, municipal Changing policy requirements  Digital signature  Positioning for future identity possibilities

6. 6 Business View of Authentication Interfaces Credential User Interface Program User Interface Credential Service Interface User Department/Agency (RP) Credential Provider(CP)

7. 7 Architecture Decisions to support the Business Model Underlying Architecture Proven Implementation Profile One Provider or Many Provider Discovery Approach User Interface consistency Functional Scope Browser-based Single Sign-On Level of Assurance Language Session Reset (Forced Logon) Single Sign- Out

8. 8 Decision 1: Underlying Architecture  We are adopting the SAML v2.0 architecture and associated set of technical standards:  SAML v2 was standardized by OASIS in 2005  Adopted by the ITU as X.1141 in 2006  The most frequently recommended standard in the RFI responses  Technical standard most widely supported by COTS products  Most widely implemented in public and private sector federations  Denmark, France, USA, New Zealand, …  Primary objective is to provide long–term interface stability for departments

9. 9 Decision 2: Proven Implementation Profile  We are adopting the US E-Authentication Profile for SAML:  The GC interface definition will be based on an existing, live, public sector implementation as a starting point  Less GC customization and associated long-term costs  Reduced risk  Greater alignment with evolving standards  Government’s successful implementations of authentication services based on SAML v2 were considered:  Denmark, USA, New Zealand  Primary objective is to ensure availability of proven interoperable COTS products for departments

10. 10 Potential Evolution Strategy New GC- Branded Credential Epass Applications Agency Federated Credential Provincial Federated Credential Bank Federated Credential OpenID etc. Credential New Applications GC Federation Hub Converted Applications Epass Credential

11. 11 Questions? Thank You bob.sunday@pwgsc.gc.ca