Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 09/18/06 issue

E-Authentication maps out its future

Agencies completing strategy to let apps use single sign-on technology

By Jason Miller, GCN Staff

The General Services Administration estimates that agencies have about 600 applications that would benefit from E-Authentication services. Right now, about 14 do.

So GSA and the government have a long way to go before they fully enjoy the benefits of a single-sign-on environment.

Officials from GSA and the Office of Management and Budget are working with agencies to figure out how and in what order the other 586 applications will start using Security Assertion Management Language or a digital certificate. Final plans, which some agencies already have handed in, are due Sept. 30.

“We are looking for systems that will get the greatest return for agencies,” said Michel Kareis, E-Authentication program executive. “The goal is all 600, but the time frame of when is what the plans will provide.”

The systems either face the public, meaning they are outside the agency’s firewall, or are internal systems that hundreds of feds use. For instance, Kareis said, Grants.gov recently became the first of the 25 original E-Government projects to adopt the E-Authentication model.

As more agencies came into the federation, Kareis said, GSA changed the funding model to support the initiative. For fiscal 2007, E-Authentication charged agencies based on their size and the number of applications using the model. For 2008, GSA is adding the number of expected transactions to the other two elements. Since 2002, GSA has charged agencies a flat fee of about $400,000 in 2005 and $500,000 in 2006.

Many agencies, Kareis said, will develop agencywide authentication portals. Once a user is validated and authorized into the portal, he can go from application to application without having to reauthenticate or be revalidated. GSA is in the early stages of developing the portals for other agencies, she said.

At the crossroads

The biggest challenge in all of this is the decision of whether to upgrade legacy applications to use the E-Authentication model.

“We asked OMB to let us determine whether older applications should be e-authenticated,” Kareis said. “The return on investment needs to be done. It is very expensive to e-authenticate older systems.”

In addition to the plans, GSA released an E-Authentication request for information earlier this month.

The RFI asked commercial and public-sector providers for information on how they could support public access to online government services.

More news on related topics: Authentication / Identity Management, E-Government, IT Management



GCN Popup