Agency Staff + Partners Pattern 1 Pattern 2 Pattern 3 Rely upon Partner(s) as an Identity Provider (and Credential Provider). Agency Federates directly. Rely upon Partner(s) as an Identity Provider (and Credential Provider). QGov used to federate. Rely upon Partner(s) as a Credential Provider, utilising QGov to verify Identity. Supports multiple partners Recommend where partners are fully trusted for identity verification May be more desirable if a common partner interacts with multiple QLD Govt agencies to mitigate duplicating federations per agency. Industry Hubs may be best placed to perform this role. is currently no identified business driver or validated business case to provide a consolidated federation point. The QGov service can provide individual identity verification against DVS if required and still allow of a partner’s credentials. Recommended when identity verification is required (if the partner’s identity lifecycle management processes are not trusted Note: The scope of QGSFAS is for internal public sector staff federation only. Agency + other Agencies Staff Pattern 1 Pattern 2 Pattern 3 (recommended) Agency brokers local Staff IdP + other Agency Staff IdP Agency brokers local Staff IdP, and use QSFAS to access other Staff IdPs Agency uses QGSFAS to access local Staff IdP and other agency Staff IdPs The FS role may be provided by the Agency Staff IdP Suitable point-to-point model, but does not scale with large numbers of agencies. Accommodates complex integration e.g. attributes, authorisation information, provisioning requirements Leverages QGSFAS to access other agencies Staff IdPs Future proofs architecture for additional agency access Removes the need for an agency broker. Future proofs architecture for MoG changes due to QGSFAS abstraction Future proofs architecture for additional agency access
subject may be either (or a combination of): A traditional online account (e.g. A one-time password or invitation code sent by the client IDM to a previously verified mobile number or registered mobile app or postal address or human messenger. A knowledge-based authentication process [See Note 3] identity documents against the source issuer database. e.g. a private QGCIDM QID identifier or verification of a public identifier e.g. TMR CRN). [See Note 2] Retrieving additional attributes of a subject by providing the subjects identity attributes which have been verified previously by a trusted entity (e.g. the IdP) as a means to authenticate the subject to their record at the authoritative source. [See Note 1] first via patterns 2 or 3. Options to maintain currency/revocation: Periodic re-query through the claimant EOI Can be achieved through a resource delegation model for person-to-self sharing where an access token provides ongoing API access Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic using shared identifier (a transactional identifier might need to be established by the authoritative source in some cases) Push events e.g. bulk load from authoritative source Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic re-query using shared identifier Push events e.g. bulk load from authoritative source Options to maintain currency/revocation: Periodic re-query through the claimant EOI Periodic re-query Notes: This requires the Attribute Provider to have an identity resolution process to resolve a remote identity to a local identity record. See the patterns below regarding linking
existing client record. An individual wishes to update their address with multiple agencies, some agency records have not been linked previously (note: may only be able to rely on data matching only – interactive knowledge-based authentication may not be possible) eligibility service requirement (e.g. proof of license, proof of training) that can be added to their digital customer identity profile for reuse with other agencies. An individual engages an agency for services and requests that they be able to interact with the agency online noting they already have a QGov Identity. An individual needs to authenticate to the agency in-person or over the phone (their QGov account could be used to facilitate authentication via MFA SMS) digital identity to be able to interact with the agency online or other agencies through re-use of the existing verification. An agency launches a new digital service which uses QGov to authenticate customers. The agency runs a marketing campaign and invite their client to register online for access. Linking process options: Identity resolution - data matching against verified identity attributes, and interactive knowledge-based authentication processes [See Note 1] Linked credential options from pattern 1 above (if available and meets assurance requirements). May be relevant for migration between customer IdPs. Using a shared public identifier that has been verified by Linking process options: Nothing specific provided the QGov identity meets the identity proofing requirements of the agency service. Linking process options: A one-time password or invitation code sent by the client IDM a previously verified mobile number or registered mobile app (push-to-swipe) or postal address or human messenger. Linking process options: A one-time password or invitation code sent by the client IDM a previously verified mobile number or registered mobile app (push-to-swipe) or postal address or human messenger.