Document steps needed to include ID verification in Login.gov agreement - Githubissues

USDAForestService / USFS-timber-permitting

The focal point for an 18F/TTS project with the United States Forest Service on timber permitting

Other

6 stars 3 forks source link

Document steps needed to include ID verification in Login.gov agreement #90

Closed MelissaBraxton closed 4 years ago

MelissaBraxton commented 4 years ago

Background This card includes follow-up actions from #76

Acceptance criteria

[ ] We have documented the steps required to put cover ID verification for firewood permitting on the existing Login.gov agreement.

Tasks

[x] Find out from Login.gov and USFS what is the cap on the current agreement for authentication and whether current agreement includes ID verification.
- [x] Determine whether we need to modify agreement to add ID verification
[ ] Estimate number of authentications and verifications we'd be adding (i.e., how many online firewood permits do we anticipate selling? in the pilot, after release 2, beyond...?)
[ ] Share this info with Login.gov folks to understand how much would be covered under the existing agreement and give us a cost estimate on any remainder.
[ ] IF mod needed, chat with Shadat Mahmud and Aaron Burk about modifications and when/how we'd need to add on to existing agreement

Definition of done

[ ] Meets acceptance criteria

MelissaBraxton commented 4 years ago

On avg 6 weeks to do an IAA mod. Too late on the current mod, but we may want to begin the process of adding ID verification right away so that we can begin testing.

MelissaBraxton commented 4 years ago

May not need to worry about estimating # of auth/verification bc/ new mod increases limit to well above possible estimate (up to 25K)

mgwalker commented 4 years ago

I have a standing invitation from Brian Fox to get USFS and Login teams together to chat about specifics.

MelissaBraxton commented 4 years ago

@mgwalker - Let's also look into whether we can implement ID verification in a dev environment before the agreement mod is complete.

mgwalker commented 4 years ago

@bboddiger Do you know if USFS has a Login.gov account manager? If not, we can talk to Brian Fox. Either way, I'd be happy to setup a short call with them where we can work out what our options are.

mgwalker commented 4 years ago

The USDA Login.gov agreement was updated a few weeks ago. It now includes identity verification (you may see it called IAL2). I believe it also increases the number of users that are supported. I'll schedule a call in the next couple of days to sync us up with the Login.gov team to make sure that a) this is the same agreement Open Forest is using and b) that ID verification is included.

mgwalker commented 4 years ago

It sounds like I was wrong! Forest Service has a separate agreement with Login.gov. We'll reach out to Silke (Login.gov agreements lead) to see about getting the details on that agreement and getting a sense of how long any necessary agreement mods would take.

Meanwhile, it sounds like it would be useful to chat with Porta (Login.gov product manager) about Open Forest's needs around identity verification and whether/how Login.gov's IAL2 supports that. Should we also loop in FS lawyers to figure out if there are any legal issues around what's acceptable for identity verification?

mgwalker commented 4 years ago

USFS agreement with Login.gov expires on 1 December, 2020

agreement is currently large enough to support firewood permits
does not include identity verification
adding identity verification would require an agreements mod
- takes 6-8 weeks, costs money

USDA has a new agreement with Login.gov that includes identity verification

USDA plans to incorporate USFS into this agreement with a mod sometime before the USFS agreement expires
unclear if USDA has been talking to USFS, but might be worth getting synced up with whoever at USDA is running that
unclear how USDA will handle costs (e.g., does it pass them down to programs?)
unclear exactly when USFS would be incorporated under this agreement

mgwalker commented 4 years ago

@bboddiger @MelissaBraxton From a timing perspective, it seems to me the best way forward is to track down the folks at USDA responsible for the Login agreement and see if they've got an idea of when they'll execute the mod to incorporate USFS. It'll be a 6-8 week process for the mod and then about an extra week to get Open Forest approved*, so I think the window for being able to get ID verification into the pilot depends on USDA starting the mod by, say, mid-September. If we know USDA is planning to do that, we can get a sandbox environment so the dev team can have something to build against while the agreements stuff works its way through the pipes. If the USDA mod won't come until later, then it doesn't seem like the best use of the dev team's time since ID verification wouldn't be ready in time for the pilot anyway.

It also seems silly to even consider using the existing USFS agreement, since it expires on 1 December anyway, and it sounds like it won't be renewed because USDA is subsuming it.

(* getting an app approved would just require having the USDA POC tell Login.gov that the app is allowed to use Login, so it can be faster or slower depending on how quickly they give the thumbs up)

MelissaBraxton commented 4 years ago

Thanks @mgwalker ! It sounds like the some of the tasks here are no longer relevant. Can you update accordingly?

mgwalker commented 4 years ago

It might be time for a new issue altogether, "since include ID verification in Login.gov agreement" is kind of moot now. The USFS agreement will never have it and the USDA agreement already does. 😄 What do you think? Should I go ahead and spin up a new issue to track tasks for getting USFS rolled into the USDA agreement and getting Login.gov integration?

MelissaBraxton commented 4 years ago

I think that's a great call!

mgwalker commented 4 years ago

Closed in favor of #172