E-Authentication maps out its future

The General Services Administration estimates that agencies have about 600 applications that would benefit from E-Authentication services. Right now, about 14 do.So GSA and the government have a long way to go before they fully enjoy the benefits of a single-sign-on environment.Officials from GSA and the Office of Management and Budget are working with agencies to figure out how and in what order the other 586 applications will start using Security Assertion Management Language or a digital certificate. Final plans, which some agencies already have handed in, are due Sept. 30.“We are looking for systems that will get the greatest return for agencies,” said Michel Kareis, E-Authentication program executive. “The goal is all 600, but the time frame of when is what the plans will provide.”The systems either face the public, meaning they are outside the agency’s firewall, or are internal systems that hundreds of feds use. For instance, Kareis said, Grants.gov recently became the first of the 25 original E-Government projects to adopt the E-Authentication model.As more agencies came into the federation, Kareis said, GSA changed the funding model to support the initiative. For fiscal 2007, E-Authentication charged agencies based on their size and the number of applications using the model. For 2008, GSA is adding the number of expected transactions to the other two elements. Since 2002, GSA has charged agencies a flat fee of about $400,000 in 2005 and $500,000 in 2006.Many agencies, Kareis said, will develop agencywide authentication portals. Once a user is validated and authorized into the portal, he can go from application to application without having to reauthenticate or be revalidated. GSA is in the early stages of developing the portals for other agencies, she said.The biggest challenge in all of this is the decision of whether to upgrade legacy applications to use the E-Authentication model.“We asked OMB to let us determine whether older applications should be e-authenticated,” Kareis said. “The return on investment needs to be done. It is very expensive to e-authenticate older systems.”In addition to the plans, GSA released an E-Authentication request for information earlier this month.The RFI asked commercial and public-sector providers for information on how they could support public access to online government services.GSA said there currently are six public and private-sector providers issuing at least two of the four levels of identity credentials.The RFI requested information on how entities would provide Level 1 and Level 2 credentials.Kareis said that among the groups GSA hopes to hear from are Visa and MasterCard, higher-education institutions and other consumer credential providers.“We are trying to find the best way to rely on outside credential providers,” Kareis said at the Enterprise Architecture Conference in Washington sponsored by the E-Gov Institute. “We are looking to adopt what industry is using as they mature or outsource things the federal government shouldn’t be doing.”This includes testing private-sector products. Kareis said.GSA is looking at letting the Liberty Alliance Project—a coalition of 160 government, commercial and nonprofit organizations, including GSA and the Defense Department, which supports the development of an open standard for federated network identity—take it over.GSA still would test agency applications for interoperability to the federated model, she added.In addition to deciding whether the Liberty Alliance Project will take over testing, Kareis said the E-Authentication executive committee is revamping the governance and standards model. The main piece is the legal suite, which is being updated and stripped down to focus on only those elements that must be formalized. The Justice Department is leading this effort, she added.Kareis also said she expects the federation model to move to SAML 2.0 sometime in early calendar year 2007.The move will come just after GSA awards a contract for the Managed Validation Translation Service, which lets users with a public-key infrastructure certificate step down and use applications that require only a Level 1 or Level 2 SAML assertion. Kareis said GSA is performing the technical evaluation.As part of the move to SAML 2.0 and the MVTS contract, GSA will hold a strategic planning session later this month to ensure the federation is evolving quickly enough and moving in the right direction, Kareis added. “We can’t afford to be static,” she said. “We need to evolve to meet our agency customer needs.”