**[eAuthentication Application Integration Form]{.underline}**

Please fill out a separate survey for each different application you
will be integrating with the eAuthentication application.

+-----------------------------------------------------------------------+
| ## General Information {#general-information .unnumbered}             |
+-----------------------------------------------------------------------+
| Agency Name:                                                          |
+-----------------------------------------------------------------------+
| Assessor Name:                                                        |
+-----------------------------------------------------------------------+
| Assessor Title:                                                       |
+-----------------------------------------------------------------------+
| Application Name:                                                     |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| ## Application System and Technical Arch                              |
| itecture {#application-system-and-technical-architecture .unnumbered} |
+-----------------------------------------------------------------------+
| Provide a description of the application and status of                |
| implementation. Include any system and technical architecture         |
| information available. Also, provide any other documentation          |
| available for the application.                                        |
|                                                                       |
| ***Questions for Business users:***                                   |
|                                                                       |
| -   ***Expected user population:***                                   |
|                                                                       |
|     -   *Number?*                                                     |
|                                                                       |
|     -   *Type?*                                                       |
|                                                                       |
| -   ***How many interactions will be available via this               |
|     application?***                                                   |
|                                                                       |
| ***Questions for Technical users:***                                  |
|                                                                       |
| -   ***What type of Application and Web Server, or Web Server, are    |
|     you using?***                                                     |
|                                                                       |
| -   ***What Operating System is used?***                              |
|                                                                       |
| -   ***Where will it be hosted?***                                    |
|                                                                       |
| -   ***How is your User Information stored? What database type do you |
|     use?***                                                           |
+-----------------------------------------------------------------------+

+-------------+-------------+------+------+-------------+-------------+
| #           |             |      |      |             |             |
| # Authentic |             |      |      |             |             |
| ation and A |             |      |      |             |             |
| ssurance Le |             |      |      |             |             |
| vels {#auth |             |      |      |             |             |
| entication- |             |      |      |             |             |
| and-assuran |             |      |      |             |             |
| ce-levels . |             |      |      |             |             |
| unnumbered} |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
| How do you  |             |      |      |             |             |
| plan to     |             |      |      |             |             |
| identity    |             |      |      |             |             |
| proof your  |             |      |      |             |             |
| users? Can  |             |      |      |             |             |
| you use     |             |      |      |             |             |
| services    |             |      |      |             |             |
| centers to  |             |      |      |             |             |
| upgrade     |             |      |      |             |             |
| your users  |             |      |      |             |             |
| to level 2? |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
| Aut         |             |      |      |             |             |
| hentication |             |      |      |             |             |
| is the      |             |      |      |             |             |
| process of  |             |      |      |             |             |
| identifying |             |      |      |             |             |
| the user    |             |      |      |             |             |
| based on    |             |      |      |             |             |
| their login |             |      |      |             |             |
| name and    |             |      |      |             |             |
| knowledge   |             |      |      |             |             |
| of a shared |             |      |      |             |             |
| secret      |             |      |      |             |             |
| (password.) |             |      |      |             |             |
| A user will |             |      |      |             |             |
| not be      |             |      |      |             |             |
| granted     |             |      |      |             |             |
| access to   |             |      |      |             |             |
| any         |             |      |      |             |             |
| protected   |             |      |      |             |             |
| application |             |      |      |             |             |
| unless he   |             |      |      |             |             |
| has         |             |      |      |             |             |
| s           |             |      |      |             |             |
| uccessfully |             |      |      |             |             |
| aut         |             |      |      |             |             |
| henticated. |             |      |      |             |             |
|             |             |      |      |             |             |
| "Assurance" |             |      |      |             |             |
| is used by  |             |      |      |             |             |
| the         |             |      |      |             |             |
| gove        |             |      |      |             |             |
| rnment-wide |             |      |      |             |             |
| eAut        |             |      |      |             |             |
| hentication |             |      |      |             |             |
| initiative  |             |      |      |             |             |
| as a        |             |      |      |             |             |
| measure of  |             |      |      |             |             |
| the         |             |      |      |             |             |
| strength of |             |      |      |             |             |
| an          |             |      |      |             |             |
| aut         |             |      |      |             |             |
| hentication |             |      |      |             |             |
| solution.   |             |      |      |             |             |
| Assurance   |             |      |      |             |             |
| is defined  |             |      |      |             |             |
| as how much |             |      |      |             |             |
| confidence  |             |      |      |             |             |
| the relying |             |      |      |             |             |
| party has   |             |      |      |             |             |
| that the    |             |      |      |             |             |
| electronic  |             |      |      |             |             |
| identity    |             |      |      |             |             |
| credential  |             |      |      |             |             |
| presented   |             |      |      |             |             |
| is done so  |             |      |      |             |             |
| by the      |             |      |      |             |             |
| person      |             |      |      |             |             |
| whose       |             |      |      |             |             |
| identity is |             |      |      |             |             |
| asserted by |             |      |      |             |             |
| the         |             |      |      |             |             |
| credential. |             |      |      |             |             |
| These       |             |      |      |             |             |
| levels are  |             |      |      |             |             |
| appropriate |             |      |      |             |             |
| for         |             |      |      |             |             |
| different   |             |      |      |             |             |
| classes of  |             |      |      |             |             |
| electronic  |             |      |      |             |             |
| tr          |             |      |      |             |             |
| ansactions. |             |      |      |             |             |
|             |             |      |      |             |             |
| **For each  |             |      |      |             |             |
| interaction |             |      |      |             |             |
| provide     |             |      |      |             |             |
| name, URL,  |             |      |      |             |             |
| and Level   |             |      |      |             |             |
| of          |             |      |      |             |             |
| Assurance   |             |      |      |             |             |
| required.** |             |      |      |             |             |
|             |             |      |      |             |             |
| -   **The   |             |      |      |             |             |
|     level   |             |      |      |             |             |
|     of      |             |      |      |             |             |
|             |             |      |      |             |             |
|   assurance |             |      |      |             |             |
|     for     |             |      |      |             |             |
|     each    |             |      |      |             |             |
|             |             |      |      |             |             |
| interaction |             |      |      |             |             |
|     should  |             |      |      |             |             |
|             |             |      |      |             |             |
|  correspond |             |      |      |             |             |
|     to the  |             |      |      |             |             |
|             |             |      |      |             |             |
| information |             |      |      |             |             |
|             |             |      |      |             |             |
|   generated |             |      |      |             |             |
|     by the  |             |      |      |             |             |
|     impact  |             |      |      |             |             |
|     profile |             |      |      |             |             |
|             |             |      |      |             |             |
|  assessment |             |      |      |             |             |
|     online  |             |      |      |             |             |
|     tool.** |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
| **          | **          | *    |      | **          | **Level of  |
| Interaction | Interaction | *Int |      | Interaction | Assurance   |
| Name**      | Development | erac |      | Production  | (indicate   |
|             | URL**       | tion |      | URL**       | Read or     |
|             |             | Test |      |             | Re          |
|             |             | (Pre |      |             | ad/Write)** |
|             |             | -Pro |      |             |             |
|             |             | duct |      |             |             |
|             |             | ion) |      |             |             |
|             |             | U    |      |             |             |
|             |             | RL** |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+
|             |             |      |      |             |             |
+-------------+-------------+------+------+-------------+-------------+

+-------------+------------+---+-------------+-------------+-------------+
| ##          |            |   |             |             |             |
| Assess Cont |            |   |             |             |             |
| rol {#asses |            |   |             |             |             |
| s-control . |            |   |             |             |             |
| unnumbered} |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
| Access      |            |   |             |             |             |
| Control is  |            |   |             |             |             |
| the process |            |   |             |             |             |
| of applying |            |   |             |             |             |
| certain     |            |   |             |             |             |
| criteria to |            |   |             |             |             |
| further     |            |   |             |             |             |
| restrict    |            |   |             |             |             |
| access to   |            |   |             |             |             |
| the         |            |   |             |             |             |
| application |            |   |             |             |             |
| even after  |            |   |             |             |             |
| the user    |            |   |             |             |             |
| has been    |            |   |             |             |             |
| aut         |            |   |             |             |             |
| henticated. |            |   |             |             |             |
| This can be |            |   |             |             |             |
| through an  |            |   |             |             |             |
| automated   |            |   |             |             |             |
| process     |            |   |             |             |             |
| (I.e., only |            |   |             |             |             |
| people from |            |   |             |             |             |
| Montana may |            |   |             |             |             |
| be allowed  |            |   |             |             |             |
| to access a |            |   |             |             |             |
| particular  |            |   |             |             |             |
| form. Users |            |   |             |             |             |
| from other  |            |   |             |             |             |
| states      |            |   |             |             |             |
| would not   |            |   |             |             |             |
| be allowed  |            |   |             |             |             |
| access even |            |   |             |             |             |
| if they     |            |   |             |             |             |
| a           |            |   |             |             |             |
| uthenticate |            |   |             |             |             |
| properly,)  |            |   |             |             |             |
| or it can   |            |   |             |             |             |
| be through  |            |   |             |             |             |
| role-based  |            |   |             |             |             |
| access      |            |   |             |             |             |
| control     |            |   |             |             |             |
| (i.e., only |            |   |             |             |             |
| repr        |            |   |             |             |             |
| esentatives |            |   |             |             |             |
| of utility  |            |   |             |             |             |
| companies   |            |   |             |             |             |
| are allowed |            |   |             |             |             |
| to access a |            |   |             |             |             |
| certain     |            |   |             |             |             |
| form. In    |            |   |             |             |             |
| this        |            |   |             |             |             |
| instance,   |            |   |             |             |             |
| agency      |            |   |             |             |             |
| adm         |            |   |             |             |             |
| inistrators |            |   |             |             |             |
| would       |            |   |             |             |             |
| confirm     |            |   |             |             |             |
| that the    |            |   |             |             |             |
| user is a   |            |   |             |             |             |
| rep         |            |   |             |             |             |
| resentative |            |   |             |             |             |
| of the      |            |   |             |             |             |
| utility     |            |   |             |             |             |
| company and |            |   |             |             |             |
| then assign |            |   |             |             |             |
| them the    |            |   |             |             |             |
| appropriate |            |   |             |             |             |
| role.)      |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
| What are    |            | E |             |             |             |
| the         |            | x |             |             |             |
| business    |            | p |             |             |             |
| functions   |            | l |             |             |             |
| for role    |            | a |             |             |             |
| based       |            | i |             |             |             |
| access?     |            | n |             |             |             |
|             |            | : |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
| For role    |            | L |             |             |             |
| based       |            | i |             |             |             |
| access,     |            | s |             |             |             |
| provide a   |            | t |             |             |             |
| list of all |            | o |             |             |             |
| the         |            | f |             |             |             |
| required    |            | R |             |             |             |
| roles.      |            | o |             |             |             |
|             |            | l |             |             |             |
|             |            | e |             |             |             |
|             |            | s |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
| For each    |            |   |             |             |             |
| interaction |            |   |             |             |             |
| or groups   |            |   |             |             |             |
| of          |            |   |             |             |             |
| i           |            |   |             |             |             |
| nteractions |            |   |             |             |             |
| within the  |            |   |             |             |             |
| same        |            |   |             |             |             |
| directory,  |            |   |             |             |             |
| identify    |            |   |             |             |             |
| the role or |            |   |             |             |             |
| combination |            |   |             |             |             |
| of roles    |            |   |             |             |             |
| that have   |            |   |             |             |             |
| access to   |            |   |             |             |             |
| the         |            |   |             |             |             |
| i           |            |   |             |             |             |
| nteraction. |            |   |             |             |             |
| Some        |            |   |             |             |             |
| examples of |            |   |             |             |             |
| c           |            |   |             |             |             |
| ombinations |            |   |             |             |             |
| of roles:   |            |   |             |             |             |
|             |            |   |             |             |             |
| -   Role1   |            |   |             |             |             |
|             |            |   |             |             |             |
| -   Role1   |            |   |             |             |             |
|     **AND** |            |   |             |             |             |
|     Role2   |            |   |             |             |             |
|             |            |   |             |             |             |
| -   Role1   |            |   |             |             |             |
|     **OR**  |            |   |             |             |             |
|     Role2   |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
| **          | **I        |   | **          | **          | **Roles     |
| Interaction | nteraction |   | Interaction | Interaction | that have   |
| Name**      | D          |   | Test        | Production  | access to   |
|             | evelopment |   | (Pre-       | URL**       | the         |
|             | URL**      |   | Production) |             | interaction |
|             |            |   | URL**       |             | (indicate   |
|             |            |   |             |             | Read or     |
|             |            |   |             |             | Re          |
|             |            |   |             |             | ad/Write)** |
+-------------+------------+---+-------------+-------------+-------------+
|             |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
|             |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+
|             |            |   |             |             |             |
+-------------+------------+---+-------------+-------------+-------------+

+-------------+-------------+-------------+-------------+-------------+
| ##          |             |             |             |             |
| Assess Cont |             |             |             |             |
| rol (contin |             |             |             |             |
| ued) {#asse |             |             |             |             |
| ss-control- |             |             |             |             |
| continued . |             |             |             |             |
| unnumbered} |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| If          |             |             |             |             |
| i           |             |             |             |             |
| mplementing |             |             |             |             |
| access      |             |             |             |             |
| control     |             |             |             |             |
| based on an |             |             |             |             |
| Common USDA |             |             |             |             |
| Attributes  |             |             |             |             |
| (User       |             |             |             |             |
| Data),      |             |             |             |             |
| please list |             |             |             |             |
| the         |             |             |             |             |
| interaction |             |             |             |             |
| and the     |             |             |             |             |
| co          |             |             |             |             |
| rresponding |             |             |             |             |
| attribute?  |             |             |             |             |
| Refer to    |             |             |             |             |
| the         |             |             |             |             |
| appendix A  |             |             |             |             |
| for a list  |             |             |             |             |
| of          |             |             |             |             |
| allowable   |             |             |             |             |
| attributes. |             |             |             |             |
| Some        |             |             |             |             |
| example:    |             |             |             |             |
|             |             |             |             |             |
| -           |             |             |             |             |
|  Attribute1 |             |             |             |             |
|             |             |             |             |             |
| -           |             |             |             |             |
|  Attribute1 |             |             |             |             |
|     **AND** |             |             |             |             |
|             |             |             |             |             |
|  Attribute2 |             |             |             |             |
|             |             |             |             |             |
| -           |             |             |             |             |
|  Attribute1 |             |             |             |             |
|     **OR**  |             |             |             |             |
|             |             |             |             |             |
|  Attribute2 |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| **          | **          | **          | **          | **Common    |
| Interaction | Interaction | Interaction | Interaction | USDA        |
| Name**      | Development | Test        | Production  | Attributes  |
|             | URL**       | (Pre-       | URL**       | (indicate   |
|             |             | Production) |             | Read or     |
|             |             | URL**       |             | Re          |
|             |             |             |             | ad/Write)** |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+

+-------------+-------------+-------------+-------------+-------------+
| #           |             |             |             |             |
| # Authoriza |             |             |             |             |
| tion and He |             |             |             |             |
| aders Varia |             |             |             |             |
| bles {#auth |             |             |             |             |
| orization-a |             |             |             |             |
| nd-headers- |             |             |             |             |
| variables . |             |             |             |             |
| unnumbered} |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| Au          |             |             |             |             |
| thorization |             |             |             |             |
| is the      |             |             |             |             |
| process of  |             |             |             |             |
| giving a    |             |             |             |             |
| user        |             |             |             |             |
| permission  |             |             |             |             |
| to do or    |             |             |             |             |
| have        |             |             |             |             |
| something.  |             |             |             |             |
| Au          |             |             |             |             |
| thorization |             |             |             |             |
| is          |             |             |             |             |
| performed   |             |             |             |             |
| within the  |             |             |             |             |
| agency      |             |             |             |             |
| application |             |             |             |             |
| but may use |             |             |             |             |
| information |             |             |             |             |
| from the    |             |             |             |             |
| eAut        |             |             |             |             |
| hentication |             |             |             |             |
| system if   |             |             |             |             |
| the agency  |             |             |             |             |
| has         |             |             |             |             |
| requested   |             |             |             |             |
| to have     |             |             |             |             |
| this        |             |             |             |             |
| information |             |             |             |             |
| passed back |             |             |             |             |
| through     |             |             |             |             |
| header      |             |             |             |             |
| variables   |             |             |             |             |
| (i.e., an   |             |             |             |             |
| agency      |             |             |             |             |
| wants to    |             |             |             |             |
| allow users |             |             |             |             |
| from        |             |             |             |             |
| Montana to  |             |             |             |             |
| fill out a  |             |             |             |             |
| particular  |             |             |             |             |
| field in    |             |             |             |             |
| the form.   |             |             |             |             |
| The agency  |             |             |             |             |
| application |             |             |             |             |
| a           |             |             |             |             |
| ccomplishes |             |             |             |             |
| that using  |             |             |             |             |
| the         |             |             |             |             |
| \"state\"   |             |             |             |             |
| variable    |             |             |             |             |
| that is     |             |             |             |             |
| passed back |             |             |             |             |
| in the      |             |             |             |             |
| header      |             |             |             |             |
| variable.)  |             |             |             |             |
|             |             |             |             |             |
| HTTP        |             |             |             |             |
| headers are |             |             |             |             |
| control     |             |             |             |             |
| information |             |             |             |             |
| passed from |             |             |             |             |
| web clients |             |             |             |             |
| to web      |             |             |             |             |
| servers on  |             |             |             |             |
| HTTP        |             |             |             |             |
| requests    |             |             |             |             |
| and from    |             |             |             |             |
| web servers |             |             |             |             |
| to web      |             |             |             |             |
| clients on  |             |             |             |             |
| HTTP        |             |             |             |             |
| responses.  |             |             |             |             |
| Each header |             |             |             |             |
| normally    |             |             |             |             |
| consists of |             |             |             |             |
| a single    |             |             |             |             |
| line of     |             |             |             |             |
| ASCII text  |             |             |             |             |
| with a name |             |             |             |             |
| and a       |             |             |             |             |
| value.      |             |             |             |             |
|             |             |             |             |             |
| **Which     |             |             |             |             |
| attributes  |             |             |             |             |
| from the    |             |             |             |             |
| schema      |             |             |             |             |
| should be   |             |             |             |             |
| passed back |             |             |             |             |
| to the      |             |             |             |             |
| application |             |             |             |             |
| in the form |             |             |             |             |
| of header   |             |             |             |             |
| variables   |             |             |             |             |
| when a user |             |             |             |             |
| logs into   |             |             |             |             |
| the system? |             |             |             |             |
| Refer to    |             |             |             |             |
| the         |             |             |             |             |
| appendix A  |             |             |             |             |
| for a list  |             |             |             |             |
| of          |             |             |             |             |
| allowable   |             |             |             |             |
| at          |             |             |             |             |
| tributes.** |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| **          | **          | **          | **          | **List of   |
| Interaction | Interaction | Interaction | Interaction | A           |
| Name**      | Development | Test        | Production  | ttributes** |
|             | URL**       | (Pre-       | URL**       |             |
|             |             | Production) |             |             |
|             |             | URL**       |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
|             |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+

+---------------------------+------------------------------------------+
| ## Applicat               |                                          |
| ion Hosting and Technical |                                          |
|  Architecture {#applicati |                                          |
| on-hosting-and-technical- |                                          |
| architecture .unnumbered} |                                          |
+---------------------------+------------------------------------------+
| Will the application be   |                                          |
| hosted at the Ft. Collins |                                          |
| or St. Louis Web Farm or  |                                          |
| at a non-webfarm          |                                          |
| location?                 |                                          |
+---------------------------+------------------------------------------+
| If is a non-webfarm       |                                          |
| location, what is the     |                                          |
| name and location of the  |                                          |
| hosting center?           |                                          |
+---------------------------+------------------------------------------+
| What operating system and |                                          |
| version does the          |                                          |
| application use?          |                                          |
+---------------------------+------------------------------------------+
| What web server does the  |                                          |
| application use (include  |                                          |
| version)?                 |                                          |
+---------------------------+------------------------------------------+
| What application server   |                                          |
| does the application use  |                                          |
| (include version)?        |                                          |
+---------------------------+------------------------------------------+
| Is the application using  |                                          |
| any existing              |                                          |
| Authentication or Access  |                                          |
| Control? If so, please    |                                          |
| describe.                 |                                          |
+---------------------------+------------------------------------------+
| What database server does |                                          |
| the application use       |                                          |
| (include version)?        |                                          |
+---------------------------+------------------------------------------+
| Does the application use  |                                          |
| a certificate? All        |                                          |
| applications must run     |                                          |
| over SSL.                 |                                          |
+---------------------------+------------------------------------------+
| A logoff page is required |                                          |
| for each site. What's the |                                          |
| name and full URL of the  |                                          |
| logoff page?              |                                          |
+---------------------------+------------------------------------------+
| Provide contact           |                                          |
| information for your      |                                          |
| application (application  |                                          |
| developer, system         |                                          |
| administrator, network    |                                          |
| administrator and         |                                          |
| business owner)           |                                          |
+---------------------------+------------------------------------------+
| If the central help desk  |                                          |
| cannot answer a question  |                                          |
| about your application,   |                                          |
| who at your organization  |                                          |
| can be contacted to       |                                          |
| provide support?          |                                          |
+---------------------------+------------------------------------------+
| Do you support remote     |                                          |
| administration (terminal  |                                          |
| services or SSH) for your |                                          |
| application?              |                                          |
+---------------------------+------------------------------------------+
| If the application is     |                                          |
| using forms, what type of |                                          |
| forms package is being    |                                          |
| utilized?                 |                                          |
+---------------------------+------------------------------------------+
|                           |                                          |
+---------------------------+------------------------------------------+
| **If the application is   |                                          |
| hosted at a non-webfarm   |                                          |
| location, please answer   |                                          |
| the questions below.**    |                                          |
+---------------------------+------------------------------------------+
| Is the application        |                                          |
| Certification and         |                                          |
| Assurance compliant?      |                                          |
+---------------------------+------------------------------------------+
| Does the domain name end  |                                          |
| with ***.usda.gov*** ?    |                                          |
+---------------------------+------------------------------------------+
| What's the IP address of  |                                          |
| the Development           |                                          |
| environment?              |                                          |
+---------------------------+------------------------------------------+
| What's the IP address of  |                                          |
| the Test (Pre-Production) |                                          |
| environment?              |                                          |
+---------------------------+------------------------------------------+
| What's the IP address of  |                                          |
| the Production            |                                          |
| environment?              |                                          |
+---------------------------+------------------------------------------+
| If available, provide a   |                                          |
| network topology diagram. |                                          |
+---------------------------+------------------------------------------+
| Describe any internal and |                                          |
| external network security |                                          |
| components on your        |                                          |
| network?                  |                                          |
+---------------------------+------------------------------------------+
| Provide contact           |                                          |
| information for your      |                                          |
| network administrator.    |                                          |
+---------------------------+------------------------------------------+

+---------------------------+------------------------------------------+
| #                         |                                          |
| # Agency User Data {#agen |                                          |
| cy-user-data .unnumbered} |                                          |
+---------------------------+------------------------------------------+
| Describe your external    |                                          |
| user community. (Do not   |                                          |
| include employees as part |                                          |
| of this description)      |                                          |
+---------------------------+------------------------------------------+
| How many users are in     |                                          |
| your directory or         |                                          |
| database?                 |                                          |
+---------------------------+------------------------------------------+
| How have you assigned     |                                          |
| assurance levels to your  |                                          |
| currently existing users? |                                          |
+---------------------------+------------------------------------------+
| If implementing a new     |                                          |
| application, how many     |                                          |
| users do you envision     |                                          |
| having (estimate is       |                                          |
| fine)?                    |                                          |
+---------------------------+------------------------------------------+
| What type of directory or |                                          |
| database stores your user |                                          |
| data?                     |                                          |
+---------------------------+------------------------------------------+
| Please describe your      |                                          |
| current registration      |                                          |
| process.                  |                                          |
+---------------------------+------------------------------------------+

**Appendix A: eAuthentication Header Variables**

The following list of user attributes will be collected upon
registration and stored in the eAuthentication centralized database. An
agency may wish to have some of these additional attributes passed as
header variables in addition to the default header variables to be used
for authorization. In addition, an agency may want the eAuthentication
engine to grant access based on these attributes.

Common Attributes Stored in the USDA Directory

  --------------------- ----------------- ----------------------- ---------- ---------------
  **Attribute Name**    **Description**   **Header Variable       **Type**   **Required/
                                          Name**                             Registration
                                                                             Level**

  USDA eAuth Internal   USDA              usda_eauth_id           Long       System Entered
  ID                    eAuthorization                                       at Level 1
                        Unique Identifier                                    

  Credential Level      Level of this     usda_credential_level   Number     System Entered
                        Credential                                           at Level 1

  AccountCreationDate   Date account was  usda_date_created       Date       System Entered
                        created                                              at Level 1

  Credential Issuer     Issuer of the     usda_cred_issuer        Text       System Entered
                        user\'s                                              at Level 1
                        credential                                           

  First Name            The first name of usda_first_name         Text       Req. at Level 1
                        the user                                             

  Middle Initial        The middle        usda_middle_initial     Text       Not Required
                        initial of the                                       
                        user                                                 

  Last Name             The last name of  usda_last_name          Text       Req. at Level 1
                        the user                                             

  Email address         User\'s email     usda_email              Text       Req. at Level 1
                        address                                              

  Address 1             Line 1 of the     usda_street_address     Text       Req. at Level 2
                        user\'s address                                      

  City                  City              usda_city               Text       Req. at Level 2

  State                 State             usda_state              Text       Req. at Level 2

  Country               Country           usda_country            Text       Req. at Level 1

  Zip                   Zip Code          usda_zip                Text       Req. at Level 1

  Home Phone            Home Phone Number usda_home_phone         Text       Not Required

  Work Phone            Work Phone Number usda_work_phone         Text       Not Required
  --------------------- ----------------- ----------------------- ---------- ---------------

It should be noted that the schema for users registered in the
centralized database is set. Fields that are required or not required
cannot be changed. If the agency would like additional information about
the user, they must collect, store, and manage that information
themselves within their own data store.

"Required fields" mean that a person is required to fill in this
information upon registration. Agencies should be aware that some of the
data fields that are "Not Required" may not be populated with user info,
for example "SSN". This should be taken into account when an agency
decides which fields they will depend on to provide customization and
authorization.

A multi-valued field means that more than one value can be stored as an
attribute.

### **Appendix B: SiteMinder Default Header Variables:**

The following table provides a list of header variables that are
automatically sent in the HTTP header by SiteMinder. These variables may
be readily used within your application to customize the user experience
or provide finer grained authorization.

  -----------------------------------------------------------------------
  **Default HTTP Header**       **Description**
  ----------------------------- -----------------------------------------
  HTTP_SM_AUTHDIRNAME           The name of the directory against which
                                the Policy Server authenticates the user.
                                The administrator specifies this
                                directory in the SiteMinder User
                                Directory dialog box in the Policy Server
                                User Interface.

  HTTP_SM_AUTHDIRNAMESPACE      The directory namespace against which the
                                Policy Server authenticates the user. The
                                administrator specifies this namespace in
                                the SiteMinder UserDirectory dialog box
                                in the Policy Server User Interface.

  HTTP_SM_AUTHDIROID            Directory object identifier (OID) from
                                the Policy Server database.

  HTTP_SM_AUTHDIRSERVER         The directory server against which the
                                Policy Server authenticates the user. The
                                administrator specifies this directory
                                server in the SiteMinder User Directory
                                dialog box in the Policy Server User
                                Interface.

  HTTP_SM_AUTHENTIC             Authentication status of the user.
                                Confirms that the user is authenticated.
                                The Agent includes this header only if
                                the user is authenticated. If the user is
                                not, this header is not returned. This
                                header is also not returned if the
                                resource is unprotected.

  HTTP_SM_AUTHORIZED            Confirms that the user is authorized. The
                                Agent includes this header only if the
                                user is authorized. If the user is not,
                                this header is not returned. This header
                                is also not returned if the resource is
                                unprotected.

  HTTP_SM_AUTHREASON            The code the Web Agent returns to the
                                user after a failed authentication
                                attempt or secondary authentication
                                challenge.

  HTTP_SM_AUTHTYPE              Type of authentication scheme the Policy
                                Server uses to verify the user's
                                identity.

  HTTP_SM_DOMINODATA            This header is for SiteMinder internal
                                use only that stores the client IP
                                address.

  HTTP_SM_REALM                 SiteMinder realm in which the resource
                                exists.

  HTTP_SM_REALMOID              Realm object ID that identifies the realm
                                where the resource exists. This ID is may
                                be used by third party applications to
                                make calls to the Policy Server.

  HTTP_SM_SDOMAIN               Agent's local cookie domain.

  HTTP_SM_SERVERIDENTITYSPEC    Policy Server identity ticket, which
                                keeps track of the user identity. The Web
                                Agent uses this to access content
                                protected by anonymous authentication
                                schemes so it can personalize the content
                                for the user.

  HTTP_SM_SERVERSESSIONID       A unique string identifying a user
                                session.

  HTTP_SM_SERVERSESSIONSPEC     Ticket that contains user session
                                information. Only the Policy Server knows
                                how to decode this information.

  HTTP_SM_TIMETOEXPIRE          Amount of time remaining for a SiteMinder
                                session.

  HTTP_SM_TRANSACTIONID         Agent-generated unique ID for each user
                                request.

  HTTP_SM_UNIVERSALID           Policy Server-generated universal user
                                ID. This ID is specific to the customer
                                and identifies the user to the
                                application, but it is not the same as
                                the user login.

  HTTP_SM_USER                  Login name of the authenticated user.

  HTTP_SM_USERDN                The user's distinguished name recognized
                                by SiteMinder.

  HTTP_SM_USERMSG               The text that the Agent presents to the
                                user after an authentication attempt.
                                Some authentication schemes supply
                                challenge text or a reason why an
                                authentication has failed.
  -----------------------------------------------------------------------