This session will concentrate on the Connect.gov cloud service, a federated identity effort being led by the United States Postal Service (USPS) and the benefits of this program to the federal agencies and to Identity Providers. We will discuss the technology behind Connect.gov service, and how the NSTIC guidelines and requirements were met by it. In addition, we will cover how demands for pre-integration with popular identity and access management (IAM) platforms were met, addressing the U.S. Federal Identity, Credential and Access Management program (FICAM) requirements. In particular, the use case where ForgeRock IAM platform was integrated with Connect.Gov for managing user access to online government services will be described.

1. Connect.gov and Identity Management
Systems
Dmitry Barinov
CTO, SecureKey
Ashley Stevenson,
Identity Technology
Director, ForgeRock

2. Copyright © Identity Summit 2015, all rights reserved.
Agenda
• The Identity Ecosystem (NSTIC)
• Connect.gov powered by SecureKey
• Cross the finish line with ForgeRock

3. Copyright © Identity Summit 2015, all rights reserved.
National Strategy for Trusted Identities in Cyberspace (NSTIC)
• White House Initiative
• Defines an “Identity Ecosystem”
• Highly Collaborative
• Private + Public Sectors
• Advocacy Groups
• Other organizations
• Improve online transactions

4. Copyright © Identity Summit 2015, all rights reserved.
Identity solutions will be:
• Privacy-enhancing
• Voluntary
• Secure
• Resilient
• Interoperable
• Cost-effective
• Easy to use
NSTIC Identity Ecosystem Guiding Principles

5. Copyright © Identity Summit 2015, all rights reserved.
• Core framework
• Steering group
• Trust frameworks
• Accreditation authorities
• Trustmark schemes
• Grants
Components of the Identity Ecosystem

6. NSTIC for access to U.S. Government Digital Services...
Copyright © Identity Summit 2015, all rights reserved.

7. Connect.gov
Copyright © Identity Summit 2015, all rights reserved.

8. Connect.gov – federated identity for Federal Government
Connect.Gov is a shared service that enables agencies to provide online services to consumers using
government approved commercially-issued digital credentials with greater security, privacy and
efficiency.
PIV
Copyright © Identity Summit 2015, all rights reserved.

9. Ensuring Privacy by Design
Connect.Gov is designed with a number of built-in safeguards to protect the
privacy of agency customers.
• Connect.Gov securely transmits requested data between agency
applications and Sign-in Partners.
• Connect.Gov does not store any Personally Identifiable Information (PII).
• Credential Service Providers (CSPs) are not able to track consumer
activity, including service/application use.
• Connect.Gov CSPs are required to comply with FICAM Trust Framework
Solutions requirements and must be certified by the program
Copyright © Identity Summit 2015, all rights reserved.

10. High Level Design
Copyright © Identity Summit 2015, all rights reserved.
Federation
Manager
RP1
Credential
Broker
RP2 RPn
CSP1 CSP2 CSP3 CSPn
CREDENTIAL SERVICE PROVIDERS
RP3
Consumer
Accessing
Government
Services
https
SAML
SAML, PKI, Open ID 2.0, OpenID Connect
AGENCIES’ WEB SITES (RELYING PARTIES – RP)

11. Application Architecture
Copyright © Identity Summit 2015, all rights reserved.

12. Agency Integration – CSP Display Options
Connect.Gov offers two methods of integration to allow a user to select credential of
choice
• Imbedded Selector – allows agencies to display the available CSPs that meet their requirements
directly on the agency page (agency hosts other messaging content) (recommended option)
• Redirect – allows agencies to have a link to a Connect.Gov hosted page with the CSPs shown
CSPs are displayed based on 2 criteria supplied by the
Relying Party
• LOA1 – shows LOA 1 – 4 CSPs
• LOA 2 – shows LOA 2 – 4 CSPs
• LOA 3 – shows LOA 3 – 4 CSPs
• LOA 4 – shows LOA 4 CSPs

13. Crossing the finish line with ForgeRock
Copyright © Identity Summit 2015, all rights reserved.

14. Copyright © Identity Summit 2015, all rights reserved.
Agencies must convert SAML into local application authentication

15. Copyright © Identity Summit 2015, all rights reserved.
Most government apps cannot natively process SAML assertions

16. Copyright © Identity Summit 2015, all rights reserved.
ForgeRock provides the critical “last mile” integration
✓ Accept standard identity protocols
✓ Transform to app-specific native requests
✓ Perform identity mapping (entity resolution)
✓ Positive user experience for new account linking

17. Thank you!