HHS / simpler-grants-gov

https://simpler.grants.gov
Other
45 stars 13 forks source link

Authenticate via Login.gov #2640

Open mdragon opened 3 weeks ago

mdragon commented 3 weeks ago

Summary

Enable grant seekers and applicants to create an account on simpler.grants.gov using the Login.gov single sign-on platform.

This experience will unblock significant parts of our future roadmap, including features like bookmarking opportunities and applying for an opportunity.

Login via other methods (AMS, PIV card) and linking an individual account to an organization are not in scope for this work.

Press release

We are thrilled to announce that the Simpler Grants.gov effort achieved another milestone today by delivering the ability for users to create a Simpler Grants.gov account. Leveraging the simple, easy-to-use Login.gov sign-in platform, the Simpler Grants.gov account creation flow minimizes the steps and friction users experience when trying to sign up. Supporting account creation paves the way for the team to deliver exciting logged-in features like bookmarking opportunities and applying for an opportunity. Stay tuned for these features and more later this year.

Acceptance criteria

Metrics

Assumptions

This work assumes that we will deliver user value via logged-in features soon. Without other features, user accounts aren't valuable.

Dependencies

This feature depends heavily on Login.gov. Since Login.gov has a strong operational track record and well-documented APIs, we think the risk involved with this dependency is minimal.

Original ticket text

Integrate Login.gov with simpler.grants.gov as an authentication service, no additional account creation is required on SGG prior to login/registration. The integration should contain a full round trip from SGG to login.gov and back to SGG with auth token and all expected back/forth fully functioning. Upon successful login the user should be able to signout, and see their name/email in the header (or somewhere else comparable in UI) next to a signout button. Any ‘my account’ page, storage of user info in db, post auth steps, etc. should all be considered separate tickets.

This deliverable will consist of two epics structured such that they could be done in parallel.

lucasmbrown-usds commented 2 weeks ago

Overall LGTM!

A couple comments:

  1. For the acceptance criteria "Once logged in, users see their email address in the simpler.grants.gov header" - are we sure that's the design we're committing to, or will it possibly change? Maybe we give it slightly more wiggle room, such as "Once logged in, users can see a clear indicator that they are logged in and who they are logged in as, such as seeing their email address in the simpler.grants.gov header."

  2. For Metrics, I like the logged in users count, that's very very simple and straightforward and the essence of the AD. Could we also propose some other metrics as well? Such as: the amount of time it takes for a user to create an account end-to-end, the number of helpdesk tickets we have about account creation on simpler.grants.gov (or some other measure of errors / failures), etc.

  3. Do we want to indicate some kind of stretch goal - so it's not required for the AD, but we'll try to see if we can do it easily - of this kind of variety, all about "Account sharing between Grants.gov and Simpler":

    A. If a user already has an account on Grants.gov, they can login to that same account on simpler.grants.gov to without needing to create a separate account on Simpler. B. If a new user uses simpler.grants.gov to create a new account, they are able to use Grants.gov to login to the same account without needing to create an account there separately. C. [This might get moved to a separate Agile Deliverable?] If a user logs into simpler.grants.gov and then navigates to grants.gov, they will remain logged in.

mxk0 commented 2 weeks ago

@lucasmbrown-usds

For the acceptance criteria "Once logged in, users see their email address in the simpler.grants.gov header" - are we sure that's the design we're committing to, or will it possibly change? Maybe we give it slightly more wiggle room, such as "Once logged in, users can see a clear indicator that they are logged in and who they are logged in as, such as seeing their email address in the simpler.grants.gov header."

Great callout. I just changed the AC to your suggested text.

For Metrics, I like the logged in users count, that's very very simple and straightforward and the essence of the AD. Could we also propose some other metrics as well? Such as: the amount of time it takes for a user to create an account end-to-end, the number of helpdesk tickets we have about account creation on simpler.grants.gov (or some other measure of errors / failures), etc.

Very open to brainstorming other metrics. I avoided metrics like "amount of time to create an account" because 95% of the flow will happen on Login.gov and is outside of our control. Errors/failures could be a good one to explore further.

Do we want to indicate some kind of stretch goal - so it's not required for the AD, but we'll try to see if we can do it easily - of this kind of variety, all about "Account sharing between Grants.gov and Simpler":

You suggested this later in your comment, but I think account sharing – assuming the spike indicates it's realistic to do – could end up being its own deliverable. We intentionally scoped this deliverable to be the absolute minimum needed to have accounts working; if we want to set a stretch goal, maybe we set an aggressive timeline (e.g. finish by the end of Quad 1, January 8) rather than increase the scope?

lucasmbrown-usds commented 2 weeks ago

All your comments sound reasonable to me! Thanks. Sounds like next steps are to (1) Explore ideas for error/failure metrics and (2) set a stretch goal on timeline.

mxk0 commented 2 weeks ago

Setting a stretch goal to deliver this by the end of Quad 1 (January 8).

mxk0 commented 1 week ago

Sprint 1.3 updates

Status: 🟢 On track

Sprint goal

The main goal for this deliverable in Sprint 1.3 was to draft a deliverable spec and begin architectural design for auth via Login.gov.

Accomplishments

Rollover

Risks

Sprint 1.4 goals

lucasmbrown-usds commented 1 week ago

We should also start prepping our Security Impact Assessment to note this change in architecture. It should not impact any of our controls much because we've already implemented all the appropriate controls for FISMA-Moderate.