Agency Staff + Partners Pattern 1 Pattern 2 Pattern 3 Rely upon Partner(s) as an Rely upon Partner(s) as an Rely upon Partner(s) as a Identity Provider (and Identity Provider (and Credential Provider, utilising Credential Provider). Agency Credential Provider). QGov QGov to verify Identity. Federates directly. used to federate. May be more desirable if a The QGov service can Supports multiple partners common partner interacts provide individual identity Recommend where with multiple QLD Govt verification against DVS if partners are fully trusted agencies to mitigate required and still allow for identity verification duplicating federations per of a partner’s agency. credentials. Industry Hubs may be best Recommended when placed to perform this role. identity verification is is currently no required (if the partner’s identified business driver identity lifecycle or validated business case management processes to provide a consolidated are not trusted federation point. Note: The scope of QGSFAS is for internal public sector staff federation only. Agency + other Agencies Staff Pattern 1 Pattern 2 Pattern 3 (recommended) Agency brokers local Staff IdP Agency brokers local Staff Agency uses QGSFAS to + other Agency Staff IdP IdP, and use QSFAS to access local Staff IdP and access other Staff IdPs other agency Staff IdPs Leverages QGSFAS to Removes the need for an The FS role may be access other agencies agency broker. provided by the Agency Staff IdPs Future proofs architecture Staff IdP Future proofs architecture for MoG changes due to Suitable point-to-point for additional agency QGSFAS abstraction model, but does not scale access Future proofs architecture with large numbers of for additional agency agencies. access Accommodates complex integration e.g. attributes, authorisation information, provisioning requirements
Agency Staff + Partners Pattern 1 Pattern 2 Pattern 3 Rely upon Partner(s) as an Identity Provider (and Credential Provider). Agency Federates directly. Rely upon Partner(s) as an Identity Provider (and Credential Provider). QGov used to federate. Rely upon Partner(s) as a Credential Provider, utilising QGov to verify Identity. Supports multiple partners Recommend where partners are fully trusted for identity verification May be more desirable if a common partner interacts with multiple QLD Govt agencies to mitigate duplicating federations per agency. Industry Hubs may be best placed to perform this role. is currently no identified business driver or validated business case to provide a consolidated federation point. The QGov service can provide individual identity verification against DVS if required and still allow of a partner’s credentials. Recommended when identity verification is required (if the partner’s identity lifecycle management processes are not trusted Note: The scope of QGSFAS is for internal public sector staff federation only. Agency + other Agencies Staff Pattern 1 Pattern 2 Pattern 3 (recommended) Agency brokers local Staff IdP + other Agency Staff IdP Agency brokers local Staff IdP, and use QSFAS to access other Staff IdPs Agency uses QGSFAS to access local Staff IdP and other agency Staff IdPs The FS role may be provided by the Agency Staff IdP Suitable point-to-point model, but does not scale with large numbers of agencies. Accommodates complex integration e.g. attributes, authorisation information, provisioning requirements Leverages QGSFAS to access other agencies Staff IdPs Future proofs architecture for additional agency access Removes the need for an agency broker. Future proofs architecture for MoG changes due to QGSFAS abstraction Future proofs architecture for additional agency access
2.-Federated-identity-blueprint-Pattern-library-v100.docx