IAM.002 All enterprise applications and services Currently, this includes CA products, such as: accessible beyond PennDOT’s network SiteMinder/Single Sign-On, environments leverage Commonwealth IdentityMinnder/Identity Manager and Secure and PennDOT standard access management Proxy Server/Access Gateway. Also includes technologies for authentication, IBM DataPower for web services. authorization and auditing. means at the site or folder level or at most granular, the web page level. IAM.003 Commonwealth enterprise directories are the If application entitlements are managed in AD preferred location for managing application along with users, it is easier to deliver Identity entitlements and attributes assigned to Management and user provisioning solutions. IAM.004 All enterprise applications shall implement a Managie configurable data in directories, fine-grained authorization and access external files and/or database tables. management architecture that is externalized Implement using patterns like RBAC, ABAC from application code and that follows and/or CBAC. broadly-recognized industry patterns. IAM.005 Users of enterprise applications and services This includes such Identity Management shall have the ability to perform Identity transactions as initial account creation, account Management transactions in self-service update, password reset/forgot password, etc. fashion to the greatest extent possible. IAM.006 User administration and provisioning of Delegated administration allows business the application entitlements shall be delegated to flexibility to provision applications they own, business owners and external business and allowing business partners to administer partners to the greatest extent possible. their own users saves Department resources. IAM.007 The use of widely-available COTS Use of technologies like CA Microsoft technologies to deliver IAM functionality is Active Directory, etc. preferable to custom coded solutions. IAM.008 All enterprise applications and services Think Internet first in order to maximize our be accessible over the Internet unless there capability to offer services to business partners is a compelling business need to the and the public and to support increased contrary. accessibility and mobility for our employees. IAM.009 All enterprise applications and services shall When logged into PennDOT network, users support Single Sign-On to the greatest extent should not be challenged for login when possible. accessing enterprise applications. When accessing via the Internet, users should only be challenged once when accessing many enterprise applications.
IAM.002 All enterprise applications and services accessible beyond PennDOT’s network environments leverage Commonwealth and PennDOT standard access management technologies for authentication, authorization and auditing. Currently, this includes CA products, such as: SiteMinder/Single Sign-On, IdentityMinnder/Identity Manager and Secure Proxy Server/Access Gateway. Also includes IBM DataPower for web services. means at the site or folder level or at most granular, the web page level. IAM.003 Commonwealth enterprise directories are the preferred location for managing application entitlements and attributes assigned to If application entitlements are managed in AD along with users, it is easier to deliver Identity Management and user provisioning solutions. IAM.004 All enterprise applications shall implement a fine-grained authorization and access management architecture that is externalized from application code and that follows broadly-recognized industry patterns. Managie configurable data in directories, external files and/or database tables. Implement using patterns like RBAC, ABAC and/or CBAC. IAM.005 Users of enterprise applications and services shall have the ability to perform Identity Management transactions in self-service fashion to the greatest extent possible. This includes such Identity Management transactions as initial account creation, account update, password reset/forgot password, etc. IAM.006 User administration and provisioning of application entitlements shall be delegated to business owners and external business partners to the greatest extent possible. Delegated administration allows business the flexibility to provision applications they own, and allowing business partners to administer their own users saves Department resources. IAM.007 The use of widely-available COTS technologies to deliver IAM functionality is preferable to custom coded solutions. Use of technologies like CA Microsoft Active Directory, etc. IAM.008 All enterprise applications and services be accessible over the Internet unless there is a compelling business need to the contrary. Think Internet first in order to maximize our capability to offer services to business partners and the public and to support increased accessibility and mobility for our employees. IAM.009 All enterprise applications and services shall support Single Sign-On to the greatest extent possible. When logged into PennDOT network, users should not be challenged for login when accessing enterprise applications. When accessing via the Internet, users should only be challenged once when accessing many enterprise applications.
Solicitation_10.docx&OriginalFileName=Appendix%20G%20-%20Enterprise%20IT%20Standards.docx