The service consumers are primarily mobile or mobile web client applications, There are bandwidth and client performance constraints The service is fine-grained or specific to a narrow business function or transaction, There are a very large number of consumers that are less well-known The service API and/or the consuming application need to evolve rapidly and share in that rapid change, There is a large volume of service requests that benefit from caching and other native benefits of REST. EAI.017 All Common Services shall be planned, designed, developed, managed and governed by a formally-recognized team. EAI.018 All Common Services should incorporate monitoring, logging and instrumentation for availability, utilization, responsiveness and adoption to facilitate Service Management. Collect, store and present data on request transaction volume, response time, number of consumers and other metrics to facilitate Service Management EAI.019 A Service Wrapper shall be implemented as a Common Service around COTS API’s to better govern consumer access to COTS functionality and to insulate consumers from complexity and change. Service wrapper will simplify consuming of COTS service API’s (e.g. FileNet P8) and ease transition to another COTS in the future. EAI.020 Solution-Specific Services are to be used only for specialized integration requirements between a provider and a number of consumers, where broad reuse is not an anticipated requirement. Mandating Common Services for all services will create bottlenecks, increase costs and Identity & Access Management The following are PennDOT’s Technical Architecture Guidelines for Identity & Access Management: TAG# Guideline Statement Additional Explanation IAM.001 All enterprise applications shall leverage Commonwealth enterprise employee, business partner and citizen directories for managing user identities and credentials. This means Microsoft Active Directories CWOPA (employee/internal consultant), Managed_Apps (business partner) and SR_PROD (citizen).
IAM.002 All enterprise applications and services accessible beyond PennDOT’s network environments leverage Commonwealth and PennDOT standard access management technologies for authentication, authorization and auditing. Currently, this includes CA products, such as: SiteMinder/Single Sign-On, IdentityMinnder/Identity Manager and Secure Proxy Server/Access Gateway. Also includes IBM DataPower for web services. means at the site or folder level or at most granular, the web page level. IAM.003 Commonwealth enterprise directories are the preferred location for managing application entitlements and attributes assigned to If application entitlements are managed in AD along with users, it is easier to deliver Identity Management and user provisioning solutions. IAM.004 All enterprise applications shall implement a fine-grained authorization and access management architecture that is externalized from application code and that follows broadly-recognized industry patterns. Managie configurable data in directories, external files and/or database tables. Implement using patterns like RBAC, ABAC and/or CBAC. IAM.005 Users of enterprise applications and services shall have the ability to perform Identity Management transactions in self-service fashion to the greatest extent possible. This includes such Identity Management transactions as initial account creation, account update, password reset/forgot password, etc. IAM.006 User administration and provisioning of application entitlements shall be delegated to business owners and external business partners to the greatest extent possible. Delegated administration allows business the flexibility to provision applications they own, and allowing business partners to administer their own users saves Department resources. IAM.007 The use of widely-available COTS technologies to deliver IAM functionality is preferable to custom coded solutions. Use of technologies like CA Microsoft Active Directory, etc. IAM.008 All enterprise applications and services be accessible over the Internet unless there is a compelling business need to the contrary. Think Internet first in order to maximize our capability to offer services to business partners and the public and to support increased accessibility and mobility for our employees. IAM.009 All enterprise applications and services shall support Single Sign-On to the greatest extent possible. When logged into PennDOT network, users should not be challenged for login when accessing enterprise applications. When accessing via the Internet, users should only be challenged once when accessing many enterprise applications.