Customers may choose to orchestrate/create their own single view of government (Government may not necessarily have a single view of customer). Client Client identity management systems operate based upon the need for a unique and persistent identity to track individuals over a lifetime (e.g. tax systems, criminal justice systems, healthcare systems, child protection systems). These systems are more expensive as they typically require a high confidence in identity and must maintain links to pre-existing identities and histories, as opposed to customer systems that allow users to create new accounts and without histories. Partner The identities of partners (individuals or businesses) assist in service delivery represent another category to be managed. Those entities may require access to government systems and or data. For example, volunteers such as volunteer firefighters, general practitioner and health care providers. As an example, for education, the identities of teachers be managed as staff identities, students are considered clients, and parents accessing student information online are considered customers which have a relationship to a client (student) identity. The table below outlines common examples of each type of identity: Staff identity Employees (individuals) In-house Telecommuters, Road warriors, Internal contractors Off-site contracts, Joint-venture partners and startups Nurses Doctors Contractors (individuals) Temporary workers IT system integrators Auditors Accountants personnel Client identity Persons (individuals) Students Registered Surveyors Licensed drivers Business (e.g. sole traders) Organisations Commercial or organisations (e.g. non-for-profit) Registered Business Registered Company Agents May be individuals or organisations acting on-behalf of an organisation or individual. Customer identity Persons (individuals) Business (e.g. sole traders) Organisations Commercial or organisations (e.g. non-for-profit) Registered Business Registered Company Agents May be individuals or organisations acting on-behalf of an organisation or individual. Partner identity Persons (individuals) Volunteers (park ranges, firefighters) General Practitioners (provider) Organisations Contracted parties NGO’s business partners vendors, manufacturers suppliers service providers The examples above are not exhaustive and will vary per department. Each of these types of identity often: are identified in different ways have (or choose to have) different identities commercial
Listing of established identifiers Example of second level appendix style The table below lists well-known and established identifiers for persons (individuals) and organisation entities. **Example only, not exhaustive** Entity Identifiers Issuer Primary domain and use Authority Uniqueness Persons - Customers Customers Queensland Government ID (QID) QGCIDM system Private identifier used for linking customer IdP to client RP records QGCIDM Business Case (CBRC approved) Globally unique due to RFC 4122 - A Universally Unique IDentifier (UUID) MyGov Identifier Federal Government Unknown Persons - Clients Healthcare Recipients Individual Health Care Identifier (IHI) Department of Health (Federal) For individuals receiving healthcare services Healthcare Identifiers Act 2010 Medicare number Department Human Services (Federal) Some Australian residents and visitors do not have a Medicare number Human Services (Medicare) Act 1973 Not unique - some people have more than one Medicare number (they are members of more than one family and may be on multiple Students Person of interest? Single Person Identifier (SPI) QPS/IJIS? Persons – Staff/Contractors Government Employees address Employee Payroll Number (or similar) Employing agency (typically the appointed payroll provider). Changes with payroll systems. address guaranteed to be unique due to RFC 822 requirements. HR or Payroll system/provider numbers guaranteed only with the same domain (may be shared across agencies using the same system/provider) Contractors Various
Organisations Australian Business Australian Business Number (ABN) Australian Taxation Office (ATO) For registered business in Australia A New Tax System (Australian Business Number) Act 1999 Unique - no two bodies can have the same ABN. Australian Company Australian Company Number (ACN) (Note: An ABN may be used in of an ACN) Australian Securities and Investments Commission (ASIC) For registered companies in Australia Corporations Act 2001 Unique - no two bodies can have the same ACN. Foreign Company ARBN (Australian Registered Body Number) Australian Securities and Investments Commission (ASIC) For registrable Australian bodies and foreign companies Corporations Act 2001 Unique - no two bodies can have the same ARBN. Healthcare Organisation Healthcare Provider Identifier – Organisation (HPI-O) Department of Health (Federal) For organisations that deliver healthcare (such as hospitals or general practices) Healthcare Identifiers Act 2010 Unique
Listing of Identity, Credential and Attribute Providers The table below provides a listing of well-known Identity Providers within and outside of Queensland Government. **Example only, not exhaustive** Common user constituencies’ identity providers (options) Considerations Customers Citizens Volunteers There are 30-40 common social media / public IdP’s addressing different user constituencies. Examples: Google Microsoft Facebook Agency Departmental IdPs QGFAS Federation Service Customers Citizens Businesses Healthcare Patients Healthcare Providers QGCIDM DTA (GovPass) Departmental Client IDM systems National e-Health Federation Various NGO’s Other Jurisdictions NGO’s as IdP’s Also consider existing industry hubs
Listing of federation services The table below provides a listing of well-known federation services for authentication available within and outside the Queensland Government. **Example only, not exhaustive** Federation authentication service IdP’s or CP’s brokered Protocols brokered/translated Notes Queensland Government Queensland Government Customer Identity Management System (CIDM) CP’s brokered: Google Microsoft Queensland Government Account (QGA) QGCIDM Step-up SMS AUSKey (via VANGuard Federation Service) Australian Business Account (ABA) (via VANGuard Federation Service) -> SAML SAML -> SAML Operated by DSITI Shop) Queensland Government Federated Authentication Service (QGFAS) CP’s brokered: Agency Employee Federation IdP’s Agency X.509 Device Certificates Agency Username/Password Credential Stores IdP’s brokered: Agency Employee Federation IdP’s Agency LDAP Identity Stores SAML -> SAML SAML -> OIDC OIDC -> SAML OIDC -> OIDC LDAP -> SAML LDAP -> OIDC X.509 -> SAML X.509 -> OIDC LDAPs -> LDAPs Aligns to QGAF AAL 2 for X-IN-CONFIDENCE classified information (agency self-assessment) Operated by Dimension Data as the Prime Services Integrator established for 1WS under the ICT for Government Buildings SOA Will be used by other providers on the ICT for Government Buildings SOA to avoid with agency IdP/CP’s. Federal Government VANGuard Federated Authentication Service (FAS) CP’s brokered: AUSKey Australian Business Account (ABA) Login with ABR attributes VANGuard brokers identity federation between Federal Government Departments, as well SAML -> SAML Agencies may federate directly with VANGuard or use QGCIDM to certain credentials Direct agency federations already in place: DETSB for AUSKey and ABA business credentials for the
as across State jurisdictions e.g. each State’s Review Office accessing the ATO’s Standard Business Reporting application. Queensland Government Business and Industry Portal (BIP) Queensland Treasury for Federation Mining and Petroleum Royalties Communities for Connection fees can apply Industry Australian Access Federation (AAF) SAML -> SAML Shibboleth -> SAML SAML -> Shibboleth SAML -> JWT Shibboleth -> JWT Used by: DET DSITI (Science Division) to access the QRIScloud (research HPC)