# Presentation: 148697

## U.S. Environmental Protection AgencyWeb Services Working Group

**Support for e-Gov Initiatives through Shareable Web Services:  E-Authentication Example**
- September 25, 2006

## The E-Authentication Pilot

- The E-Authentication Pilot is a good example of the challenges and opportunities facing EPA in the use  of web services to address new initiatives

## E-Authentication and Identity Management

**Some relevant IM definitions:**
**Identity** -- A unique identifier for an individual person.  The ***identity*** of a person must include sufficient additional information (for example an address or some identifier such as an employee or account number) to make the identity unique.
**Identity Proofing** -- The process by which a trusted credential issuer ***collects*** ***and validates*** sufficient information to uniquely identify a person applying for a credential
**Authentication** -- The process of confirming the identity of individuals who want to access a computer system or other resource by ***validating their*** ***credentials*** (PIN, password, digital certificate, etc.)
**Authorization** --The process of ***granting access*** to resources based upon the identity and assigned role/privileges of an individual

**E-Authentication and Identity Management**

## E-Authentication Background

**What is GSA’s E-Authentication Initiative?**
- Federal E-Authentication initiative is dedicated to the vision of identity credential re-use across computer systems
- EPA and several other Agencies are partnering with GSA to make this vision operational
- Goal is to minimize or eliminate the need to register for and use multiple credentials, reducing the cost/burden on federal employees, businesses, ordinary citizens, and state and local government officials who access federal systems
- If credentials can be re-used, then individuals need not acquire and keep track of separate credentials for each computer system they access
- Focus is on meeting the authentication needs of other E-Gov initiatives
- Design allows member computer systems to accept credentials that they did not issue themselves, i.e., establish an identity trust
- Key components of the architecture: E-Authentication Portal, GSA Interoperability Lab, and Certificate Validation Services
- Becoming an OMB mandate to use GSA’s E-Authentication services

## E-Authentication Pilot Background

**What is the EPA E-Authentication Pilot?**
- Collaborative effort between EPA, GSA, and Indiana to use the E-Authentication architecture and leverage existing EPA web services to allow the State’s EMITS application to authenticate users
- Project Goals/Objectives
- Successfully pilot test State usage of GSA’s E-Authentication services, and single sign-on capabilities
- Enable States to easily process data submissions signed with digital certificates issued by their state and federal partners
- Enhance the level of authentication services that can be provided to States through the network
- Enable States to achieve Cross-Media Electronic Reporting and Records Rule (CROMERR) compliance
- Demonstrate the potential savings that States can accrue by utilizing the Exchange Network and GSA e-Authentication capabilities
**E-Authentication Pilot will migrate to Production in March 2007**
- Some components available before the end of this year

## EMITS eAuthentication Production Implementation Conceptual Model

- Existing* *XML Web Services
-  <message name=“Authenticate”, “Validate">

**EMITS eAuthentication Production Implementation Conceptual Model**

***New*** XML Web Service
-  <message name="ValidateCert">

***New*** Technology
- Certificate Arbitration Module (CAM)

## How does the E-Authentication Pilot relate to the WSWG?

**How does the E-Authentication Pilot relate to the WSWG?**
- Project provides a good opportunity to develop and expose ***web services*** relating to digital certificate validation
- Many potential applications within CDX and Exchange Network, but...
- A powerful w/s resource made more powerful by ***sharing***
- Similar potential applications exist within the Agency
- Potential for sharing such generic services with other entities (States, Other Federal Agencies, etc.)
- Sharing means increased responsibilities, and requires certain safeguards and higher level oversight to reduce risks

## Similar Challenges Face E-Auth and the WSWG

- E-Authentication web services face the same challenges as many other potentially shareable web services in the Agency.  The WSWG needs to address these challenges to maximize the advantages of web services.
**Marketing/Advertising the Service Offering**
- How do you make people aware of the service?
- Through live WSWG Presentations (Major Services)
- Inclusion in WSWG Publications (eMail, Print, & Website) (All Services)
- ITS-ESE Web Services Inventory (All Services)
**End Point Publication/Registration**
- Add to EPA UDDI Registry
**Governance**
- Establishing Ownership / Controlling Change / Discouraging Duplication
- Architectural tracking mechanisms (i.e., where is this w/s used in EPA Systems)
**Use of W/S in Operational Scenarios**
- Establishment of SLAs for a shared services (Availability/Chargeback)
- Following common usage/security standards
**Others?**

## Next Steps/Discussion

- Next steps required of WSWG to support E-Authentication and other shareable services:
- Remove the impediments to the sharing of W/S, such as
- Don’t know how to expose or properly secure w/s
- Loss of Control / Increased Obligation
- Sensitivity to Loss of Assets, External Financial Obligations
- Establish foolproof method of finding/identifying shareable services across the Agency
- Identify and leverage existing (EA?) products to find and manage w/s offerings
- Gain agreement on marketing/advertising mechanisms
- Develop Governance mechanisms with respect to W/S lifecycle
- Orgs need to understand authority/responsibility with respect to w/s development and deployment
- Prioritize WSWG Working Objectives with respect to these issues
- Schedule meetings – Prepare recommendations

***Who and How?***