MHV LOA: Implement LOA1-2 "Verify" alert for My MHV basic credentials on MHV landing page

wesrowe commented 6 months ago

Description

User story

As a Veteran signed-in using a non-LOA3 My HealtheVet basic credential, I want to see a contextual alert that tells me I cannot use this sign-in credential. I want to clearly be told what to do next isntead: create a new Login.gov or ID.me account, verify it, and register with My HealtheVet. This will help me understand why I can't see the My HealtheVet on VA.gov tools and have clear instructions for getting unstuck.

Background

Our existing "Verify your identity" is inadequate/wrong for MyHealtheVet basic (LOA1) credentials
For My HealtheVet basic account holders, they'll be forced into an ID.me wrapper when they sign into VA.gov with this credential for the first time (shown in this Mural) This creates a shadow ID.me account for the user in the background.
- Steps to creating an account with either ID.me or Login.gov given this scenario are described in the alert content.
MHV Premium accounts are no longer advertised. Instead, these users will be asked to create an ID.me or Login.gov account.
Once they verify their identity with one of these credentials, they may still need to register with the My HealtheVet National Portal to unlock access to any applications that run on the MHV-API – a totally different process.
Design and flow logic in Figma

Notes:

This alert needs to display for:
- users who are signed-in with non-LOA3 My HealtheVet credentials
User flow of landing page alerts documented in Figma here
Link to specific Figma frame for this alert

Screen shot

Alert content:

H2 You need to sign in with a different account to access My HealtheVet

body text To protect your health information and prevent fraud and identity theft, we can only give you access when you sign in with a verified account. You have 2 options: a verified Login.gov or a verified ID.me account.

If you already have a Login.gov or ID.me account, sign out of VA.gov. Then sign back in using that account. We’ll tell you if you need to verify your identity or take any other steps.

If you want to create a Login.gov account, follow these steps:

Sign out of VA.gov
On the VA.gov homepage, select Create an account. Create a Login.gov account.
Come back to VA.gov and sign in with your Login.gov account. We’ll help you verify your identity and register your account to access My HealtheVet on VA.gov.

If you want to create an ID.me account, you should know that we started this process for you when you signed in to VA.gov. Follow these steps to finish creating your account:

Sign out of VA.gov
On the VA.gov homepage, select Sign in. Select ID.me from the sign-in options.
On the ID.me sign-in screen, select Forgot password. Enter the email address you used when you signed in to VA.gov.
Set up a new password and finish signing in using ID.me. Then, ID.me will help you finish creating your account.
Come back to VA.gov and sign in with your ID.me account. We’ll help you verify your identity and register your account to access My HealtheVet on VA.gov.

button [button] Sign out link [link] Learn more about how to access My HealtheVet on VA.gov

Tasks

[x] Ensure identity team (Tom Black) has access to the video showing that shadow ID.me instances are created for MHV basic credentials upon sign-in on VA.gov. Per comments in this thread.
[x] Implement alert for MHV basic (non-LOA3) users to see on the My HealtheVet home page upon sign-in
[x] Ensure that the landing page design around the alert reflects Figma here (remove the secondary nav + the grey boxes for the health tools)

Acceptance criteria

[x] Worked in same branch as #83069 so that they are released together
[x] New alert is implemented on the My HealtheVet home landing page for users with unverified (non-LOA3) My HealtheVet basic credentials
[x] Landing page design surrounding the alert is updated to match the Figma file
[ ] UX review
[x] QA review
[ ] a11y review

wesrowe commented 6 months ago

@sterkenburgsara – FYSA, I added a link to your "Verify" Figma file in the main ticket body above. Please update this ticket when content and CTA link destination are known for the MHV credential.

wesrowe commented 5 months ago

Designs are still in flight (CAIA), and no clear timeline to resolution. NOT taking into Sprint 27 at this time.

wesrowe commented 5 months ago

Per slack thread on 3/19, CAIA still noodling.

wesrowe commented 5 months ago

slack thread from recent days about the possible (but unlikely) need for a version of this alert where the sign-in service is not specified.

wesrowe commented 5 months ago

@sterkenburgsara, I would appreciate your pinging CAIA when you have a chance. And please link the relevant CAIA ticket on this one.

sterkenburgsara commented 3 months ago

Note: identity team has updated the acronyms that they use to refer to identity verification levels. LOA1 is now IAL1 and LOA3 is now IAL2.

wesrowe commented 3 months ago

Per Sara, this ticket is blocked by a new need to revise the content. Removing it from Sprint 32, hope for new content by S33.

sterkenburgsara commented 2 months ago

Per this thread from last sprint, we were asked to hold on implementing this alert until a technical step (that a shadow ID.me account is created for MHV basic users when they log in using their MHV credential on VA.gov) mentioned in the alert content can be validated with Carnetta Scruggs and Joe Niquette.

Myself, Patrick, Laura W., and Danielle Thierry synced on 6/25/2024 to discuss and the following were determined as next steps:

Patrick will email Carnetta (and Joe) to get verification that shadow ID.me accounts are created when these users first sign onto VA.gov using their basic accounts
Laura W. and Sara S. will take another pass on simplifying what we communicate around the ID.me section of this alert & mock it up again
Longer-term goal beyond these alerts: eliminate the ID.me wrapper that these users see when they first sign into VA.gov and simply don't allow MHV basic accounts anymore - users need to already have an MHV Premium account to access My HealtheVet with that credential type.

sterkenburgsara commented 2 months ago

Carnetta's response to Patrick's email is the bolded terminology in the image below (see words: nope, maybe, something else) - this response is not clear to me. Laura and I are hoping that Patrick will follow-up and we will wait until they figure this out before editing content.

sterkenburgsara commented 1 month ago

@jzucadi sorry for late-changes, but I synced with @jonathanjnelson and @carlosfelix2 yesterday about standardizing things we're exposing for various alerts. In that call, it was decided that lots of things I originally put in the Figma file for this alert should not display for this scenario, where the user is not signed in with an ID-verified account. I also commented on the PR & will update Figma asap.

jzucadi commented 1 month ago

This work is blocked due to more UX changes being decided on, details in this thread: https://dsva.slack.com/archives/C0581MN69TJ/p1722261242087759?thread_ts=1722260409.416559&cid=C0581MN69TJ

jonathanjnelson commented 1 month ago

@jzucadi Please see updated content in Figma here

jonathanjnelson commented 1 month ago

allanto-ah commented 3 weeks ago

Environment: Staging, Production

In staging, the MHV account login doesn't work so I created a MHV basic account in production to test this alert. Verified that the alert appears for my prod account. In staging, verified that this alert doesn't appear for id.me login types

sterkenburgsara commented 3 weeks ago

Are links destinations being checked/ verified as part of QA process? If not can I do a check on alerts too?

On Thu, Aug 15, 2024 at 13:53 Allan To @.***> wrote:

Environment: Staging, Production

In staging, the MHV account login doesn't work so I created a MHV basic account in production to test this alert. Verified that the alert appears for my prod account. In staging, verified that this alert doesn't appear for id.me login types Screenshot.2024-08-15.at.10.24.46.AM.png (view on web) https://github.com/user-attachments/assets/85d91e5f-e28b-48a5-8e4b-355b39643241

— Reply to this email directly, view it on GitHub https://github.com/department-of-veterans-affairs/va.gov-team/issues/77357#issuecomment-2291991236, or unsubscribe https://github.com/notifications/unsubscribe-auth/A3NULPHHDPKESKSMPVIZ2MLZRT2LRAVCNFSM6AAAAABD66VSYKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJRHE4TCMRTGY . You are receiving this because you were mentioned.Message ID: @.*** .com>

allanto-ah commented 3 weeks ago

Yes they are!

sterkenburgsara commented 3 weeks ago

Yay, go team! Thanks for confirming.

On Thu, Aug 15, 2024 at 16:45 Allan To @.***> wrote:

Yes they are!

— Reply to this email directly, view it on GitHub https://github.com/department-of-veterans-affairs/va.gov-team/issues/77357#issuecomment-2292324828, or unsubscribe https://github.com/notifications/unsubscribe-auth/A3NULPDDLLC7LPKWOBQFVQ3ZRUORPAVCNFSM6AAAAABD66VSYKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJSGMZDIOBSHA . You are receiving this because you were mentioned.Message ID: @.*** .com>

department-of-veterans-affairs / va.gov-team