Determine Navigation Structure

[lachellel]

• Consolidate based on audience
• Rearrange for a logical flow of information
• Suggestions for flow please state here

[indrajit-gsa]

Here are my suggestions on the federation playbook. Please provide inputs. I am using the CSP and RP references instead of IdP and SP since it seems that is what has been used in these contexts and differentiates the CSP vs AP from IdP.

Federation Playbook Content

What is Federation

• Overview of what federation means from a program management perspective. Include diagram of user flow across CSP, RP and possibly AP. Include government relevance/context as applicable. State the various guidelines for federation including the ICAMSC roadmap, NIST publications for federation of identities, Relying party guidance etc.
• Why federate - Explain when federation is needed - not to manage the same credentials in different organizations. Cost savings, increased security, interoperability, user friendly information sharing, eliminate redundancy, protect PII. Include use cases such as disaster response situation including fire fighters and first responders when other organization credentials can be utilized.
• Who needs it - Those who have detailees from other agencies or special programs from other agencies or commercial partners. federal, local, state context. Foreign nationals for NASA and FVEY context.
• How does federation work - Explain each component in the federation workflow in more detail for architects/engineer. Explain authentication, authorization in more detail. May explain the securing aspects of transferring data between actors using tokens/assertions – confidentiality/privacy, integrity/non-repudiation.

How to Plan For Federation

• What are the project considerations – Check lists of business considerations – upfront cost, maintenance cost, estimate benefits and phased approach.
• Who are your users - Describe why user population is key in establishing the implementation path of the federation process – interagency federation vs federation with external agencies. Describe authentication schemes needed.
• Who is the relying party – understand the service provider environment, gather and analyze documents, conduct application assessments, update documents. Mitigate risk if any for the relying party.
• Who is the Identity Provider or CSP – Explain what are the basis for selecting the identity provider, how they manage identities including identity proofing (how detail should this be?). Refer back to the user population and identity management methods used.
• Who is the Attribute Provider – What does an attribute provider do? Is this an entity outside of IdP or SP? We can include the account linking scenarios based on attribute exchange. Account linking patterns – what happens when multiple accounts are matched to one identity?

How to Architect

• What are the federation topologies – point to point, hub spoke, networked topologies.
• What is the Federal Trust Framework – Describe what this is – Federal PKI, Open Identity Initiative, why is this important for federating identities?
• Evaluate existing infrastructure and services
• How to decide on a federation architecture - Discuss different types of federation architectures. Include multiple IdP and federation brokers. Include IaaS. Select an optimal solution (provides the most functionalities and easy to implement).

How to Implement

• Integrating with IdP and AP - FICAM approved IdPs. Determine acceptable credentials and assurance levels (LOAs). Introduce compensating controls in risk based authentication. Attribute mapping.
• How to manage internal/external users - Describe why Identity lifecycle is important in the context of federating identities across the disparate systems.
• How to link accounts – account linking patterns. This is a very important topic of implementing federation.

How to Maintain

• How to manage the federation ecosystem – Level of service/uptime, monitoring networks. End user tickets and response to events
• Periodic review of IdP/CSP -
• Account management - Account lifecycle monitoring , manage linking issues, account cleanup etc. Determine additional credentials and profile types.

Other considerations

• Security Threats – What are the processes involved in security review of credentials and accesses over periods of time. Should they implement periodic re-certification? Different scenarios where credentials may be compromised. Threat mitigation (though this would become a wider topic).
• Use Cases/Scenarios – Describe the scenarios with examples (if allowed) to implementations in government context. o NIH o DHS

[indrajit-gsa]

Pull request #21 submitted for the initial navigation structure. Individual issues will create branches from staging once this pull request is merged.

[indrajit-gsa]

Here is the preview link - https://federalist-proxy.app.cloud.gov/preview/gsa/ficam-federation/10-navigation/