USDA takes E-Authentication to a new level

The Agriculture Department is one of a handful of agencies that don't have to worry about meeting the administration's goal of using e-authentication services for at least one of its applications.Agriculture already has 122 systems that accept a Level 1 or Level 2 authentication and plans to add 20 to 30 more before Sept. 30, said Chris Niedermayer, USDA's associate CIO for enterprise planning, project and information management.Agriculture recently became the first agency to provide Level 1 or Level 2 Security Assertion Markup Language 1.0 credentials. Six other agencies provide digital certificates under Level 3 and Level 4.OMB in 2003 laid out four assurance levels for e-authentication. They are:Level 1: For applications that require little or no assurance about the identity of the user, such as a citizen logging on to a customized Web page.Level 2: For applications in which it is highly probable that the user's identity is accurate, such as a federal employee taking courses through an online education site.Level 3: For applications that require a high degree of confidence that the user is authentic, such as a lawyer who provides patent data to the Patent and Trademark Office.Level 4: For applications in which it is absolutely necessary that the user's identity is accurate, such as a law enforcement official accessing a federal database of criminal records.To kick-start the single-sign-on capability, OMB has asked every agency to have at least one application this year and one in 2006 use the e-authentication architecture. While progress across government has been mixed, USDA's success offers a glimpse of the future.'What this means is, when we issue a credential to an employee, industry partner or customer, it will be accepted by all other SAML-compliant services,' Niedermayer said. 'The government is trying to create interoperability where citizens are in the driver's seat. They get a credential and can travel anywhere in government with that one credential.'USDA already has issued 83,000 credentials to employees and 56,000 to contractors and other citizens to use on its 122 applications. Niedermayer said employees and citizens used the authentication service 1.2 million times in June.'This means 130,000 people can one day go to the Social Security Administration or the IRS or any other agency and use this one credential,' he said. 'That is our ultimate goal.'USDA's 130,000 employees join more than 1 million other employees who now possess Level 1 or Level 2 credentials through the Office of Personnel Management's Employee Express, an application that gives feds access to personnel data.The next step is for SAML-compliant systems to accept Level 3 and Level 4 certificates. Steve Timchak, the General Services Administration's project executive for E-Authentication, said the Treasury Department is testing a 'step-down translator.'USDA also is testing a step-down translator allowing employees or citizens to get Level 3 credentials from Agriculture's National Finance Center, which is certified as a Level 3 provider, and use them on Level 2 and Level 1 applications.Interoperability of certificates is an important step in achieving the single-sign-on capability.Currently, GSA has certified 11 products as SAML 1.0-compliant and is not testing any more.It wants to start testing SAML 2.0-compliant products, but Timchak said products have to be on the commercial market before testing can begin. He said he doesn't know of any products that are past the beta stage.USDA is using Netegrity Site Minder software from Computer Associates International Inc. The software requests credentials when a user tries to access the service, then determines whether a credential is valid. If so, it creates a user session.Users can go from application to application within the same session'the biggest benefit of a common credential, Niedermayer said.To become certified, USDA had to prove to a team from GSA that its processes issuing credentials were secure and strong, Timchak said.'They had to do some work to tighten up the issuance of user IDs and passwords,' he said. 'We do due diligence to see how they safeguard the credentials.'For instance, Timchak said, OPM's Employee Express had to change its PIN and password rules to get certified. OPM had to move to a 6-to-8-digit PIN from a 4-digit PIN and reduce from an unlimited number to three the number of log-in tries before the user was locked out.With the certification, USDA has received a lot of interest from other agencies in how they did it and whether USDA could provide Level 2 certificates for them.Niedermayer said the department will figure out whether it will get into the business of providing certifications when it submits its 2007 budget request to OMB in September.'This is an 'if you build it, they will come' scenario,' Niedermayer said. 'As people see it as real and there is a market, more and more people will come to the table.'