Speaker: This video will cover CAIA
and SailPoint user access.
We will discuss the following;
CAIA Introduction,
User Experience,
Agency User Access Paths,
Identity Verification,
PIV/CAC,
ID.me,
SailPoint Identity Creation Steps,
Access Multiple G-Invoicing Environments,
FAQ; things you should know.
We will cover the Requester Process Flow
and lastly, Access Documentation.
To meet Treasury's requirements
for securing agency access to Treasury applications,
CAIA, or Common Approach to Identity Assurance,
is being implemented with G-Invoicing.
The new Treasury mandate is for CAIA to be implemented
by the end of Q4 2023
for all fiscal accounting applications.
Agency users will need to utilize either
PIV/CAC or ID.me
for identity verification to access G-Invoicing.
Fiscal service migrates existing
G-Invoicing agency accounts
with their user accounts intact into CAIA SailPoint.
Current G-Invoicing users
will be able to log into G-Invoicing environments
immediately without user or administrative intervention
providing the following are true;
User account is active in G-Invoicing,
the user identity verification
has been linked previously to G-Invoicing
and no changes will be required
to existing user account settings in G-Invoicing
per G-Invoicing environment.
The expected user experience will be
the G-Invoicing users logs into
ID.me or PIV/CAC,
selects the appropriate SailPoint roles
and then begin accessing G-Invoicing.
This slide reviews the path users
and administrators will follow to gain access
to G-Invoicing.
It must be noted that current users
will need to register with either PIV/CAC
or ID.me identity verification
if their PIV/CAC has not been previously
linked to G-Invoicing.
Current users can then access G-Invoicing immediately.
For new users,
the first step is to register with either
PIV/CAC or ID.me identity verification.
Next step is to access SailPoint registration
and gain approvals in SailPoint
and lastly, the new user will be able
to access G-Invoicing
via PIV/CAC or ID.me.
This slide covers
the paths for existing or migrated users
accessing CAIA G-Invoicing.
The first row is what we would call the happy path
that most agency users will experience.
Users will select a hyperlink
provided by the agency UA
per environment.
The user will need to access
or register with either PIV/CAC or ID.me.
The user will then access SailPoint.
It will be sent to requester's email address
for initial verification.
The user can then request SailPoint roles
for G-Invoicing environment access
once per environment request.
The user can then use their identity verification
link to access G-Invoicing following approval completions
in SailPoint.
This slide covers the paths
for new users requesting access into CAIA G-Invoicing.
The user will pursue the following steps;
The user will select the environment link.
The user will then validate their identity
with the agency dictated identity validation portal.
The user may need to provide validation verification
documentation as part of this step.
The requester then logs in again
to validate into SailPoint.
This slide provides a quick view
of the CAIA SailPoint and G-Invoicing available URLs.
The CAIA SailPoint links are useful for new users
and also for users and administrators
that need to manage or approve SailPoint roles.
The G-Invoicing URLs are useful
for accessing G-Invoicing post
identity verification.
This would include authorized G-Invoicing users
and authorized G-Invoicing administrators.
This slide provides a summary
of the PIV/CAC validation process.
It should be noted
that each agency follows
agency specific guidelines
for acquiring a PIV/CAC card.
G-Invoicing requesters should work
with their agency G-Invoicing point of contact
in order to pursue this step.
The user would navigate to the provided CAIA web link,
noting the two
URLs below for QA-C and production.
The user will insert their PIV/CAC card into the reader.
They will then validate the PIV certificate
that is based on their computer.
The user will then be prompted to supply a pin code
that has already been set up.
The user will then verify their email address
via their PIV/CAC card.
A code is emailed to the requester
which needs to be entered into the system when prompted.
A last step in SailPoint will be required
in order for the user to gain their supervisor
manager's approval
and to select
SailPoint roles
for G-Invoicing environment access.
This slide shows step three
where the user
is validating the certificate assigned on their computer.
That is linked with their PIV/CAC card.
Here, the requester is providing
their known pin
when prompted by their PIV/CAC card
that has been placed into the reader.
Then when first attempting to access SailPoint,
the user must supply their email address
that will be validated against their PIV/CAC card.
SailPoint will then send to that email
a validation code.
We can see here the email provided.
This is a representation of the user entering the code
into SailPoint as part of the validation process.
Once that is done, the requester can then move forward
with requesting SailPoint roles
and gaining their supervisor manager approvals.
These steps will be covered in a later set of slides
in this video.
ID.me is an authentication option
for when users do not have a PIV/CAC card.
Below are the steps required to create
an ID.me account.
A new user would utilize a CAIA SailPoint URL
and when prompted, select the ID.me button,
follow the onscreen instructions to sign
in with an existing account
or to create a new account.
If prompted,
follow the onscreen instructions to verify your identity.
The note at the bottom of the slide
provides the URL
to ID.me for support and documentation needs.
To begin the SailPoint identity creation process,
the requester will click on the hamburger menu
to display the options
and will select Modify Manager
as indicated in the slide.
The requester must provide the email address
of either a supervisor or manager
at the first level of approvals.
SailPoint will automatically notify
the supervisor manager
who is the user's approver to review the request.
Again, this is based on the email address
provided by the requester earlier in SailPoint.
Once the request has been completed,
SailPoint will then send a request notification via email.
This is done via CAIA
and so therefore, the message will come from CAIA.
This slide displays an example notification
indicating that the supervisor manager
has completed their review
and approval process in SailPoint.
Once the requester receives a validation
of approval from their supervisor manager,
they can move forward with accessing SailPoint again
and selecting Manage My Access.
Requester will request SailPoint roles
for either acceptance
or for production.
In the search access bar,
type a few letters of your agency name
and then select search.
With the results showing up in the same page,
select the correct agency name
and environment
to request access for your G-Invoicing agency account.
The note at the bottom of the slide indicates
that when selecting G-Invoicing,
be careful as there may be multiple
treasury applications populating
in the options list below.
Agency requesters will be able
to select the review and submit tab
in order to add comments
to assist their supervisor manager
in improving their request.
The requester can also choose to select
next to go to the same location.
It is highly recommended
that agency requesters should add a comment
as part of their request
by selecting the green comments icon
on the right hand side
of each SailPoint role being requested.
Requesters should indicate
the agency name, the purpose of the access being requested,
the environment being requested,
to request your email address,
the supervisor or manager email address,
the requester's role in the agency, bureau or sub bureau.
This will help your supervisor manager
to approve while they're doing their review.
This slide is showing the dialogue box
that will be presented once you select the comments icon
to allow for the stated information
to be entered for your supervisor
or managers review when validating your request.
This slide displays the final step
for the SailPoint approval process.
The requester reviews the selected SailPoint roles
by clicking on the review and submit tab
and selecting the submit button.
Once submitted, SailPoint will display
the homepage with a successful message that looks
like to screenshot below.
It may take the system a few moments
for the user's identity to be processed in SailPoint.
The next slides show CAIA notifications
during the SailPoint approval process progression.
We can see these notification emails here.
This one is for when the request has been submitted.
Here, the requester is awaiting approval
and finally the requester
will received this email
where the request has been completed.
Multiple accounts can be accessed via one email address.
To do this, we would enter the email address
with the plus modifier
and then something after that.
You can see in the examples below,
we are requesting for the same email address,
adding the plus modifier
and in the example, QAC for the QAC environment,
the email address, the plus modifier has
a modification if you will, to be accepted by SailPoint.
Most email services do support
the plus modifier.
If your agency does not recognize the plus modifier,
then no notifications will be received
by the email address when submitting for new roles.
We wanted to provide additional information
that may be useful to both users
and their administrators
for accessing G-Invoicing via CAIA and SailPoint.
For example, users must still access G-Invoicing
within 120 day period
to remain active.
CAIA and SailPoint do not monitor this
and will not be sending out email notifications
as the users get closer to this 120 day lapse.
G-Invoicing user administrators will only need
to uncheck the inactive box
to reactivate a G-Invoicing user
that has not logged into G-Invoicing
for more than 120 days.
While we have said this previously in this video,
we wanna make sure folks know
that supervisor manager approval is required
for
how long a requester should wait
varies within the agency
but is recommended within 48 hours,
if you do not receive a response
supervisor or manager
via email notification that the manager should be contacted.
We should double check in SailPoint
what email address was provided
for their supervisor manager
in case it was incorrectly entered in SailPoint.
If incorrect supervisor manager email addresses
were entered,
the requester will need
to modify their profile in SailPoint
to add the correct supervisor manager email address.
This is covered in the user guide of G-Invoicing.
Again, the requesters should add comments
to their supervisor manager
in SailPoint as part of their requesting experience.
This slide provides a detailed view
of the requester validation
in SailPoint role requesting process flow.
This slide provides details for accessing
the TSC or Treasury Support Center
for CAIA SailPoint support.
The TSC will be able to provide
user identity setup support,
SailPoint and access support,
application approver and requester workflow support,
role and entitlement modifications,
existing user support
and also any third party CSP required support as needed.
In this demonstration, we will register an ID.me
as a new G-Invoicing user.
We will be using an environment with a similar experience
as new users will have
when logging into the QAC environment.
We will select the ID.me
and we will select to create an ID.me account.
Here we entered the email address,
supplied the password
and we checked the box at the bottom
to accept terms and conditions presented by ID.me.
We will select the create account button.
We will be following a series of prompts
and providing a series of information
and documentation.
We will be completing a simulated experience here.
Here we will be defining with ID.me
the multifactor authentication
by which we will be registering with ID.me.
Select text messaging for the MFA
or multifactor authentication.
Provide a phone number.
Select text or call me.
Select continue.
While this is simulated,
you would be receiving this
code via your phone,
via text as I selected
and we'll select continue.
Select continue again here
and now we're gonna choose
one of three different methods
to provide validation documentation.
We'll select driver's license,
acknowledging terms and conditions
and selecting continue to receive
a linked set of information.
I will go ahead and use the testing only here
for demonstration purposes
and we will continue to accept
and move things forward here
with our email address verification.
We'll now begin to take the photos
of the validation documentation
as requested.
And here we're being asked to provide front
and back of our driver's license.
That was the selection
that I had made previously
and I provided a selected
piece of imagery there
instead of my driver's license for the front.
Going to do the same for the back
of the driver's license now.
And here, we'll go ahead and select submit your photos.
I am being asked to take a selfie
and if we were in the production environment,
we would have to supply all of this information,
including a selfie.
I will select continue here.
Next, we are prompted to supply our
social security number
and select continue.
We are presented with a summary of information
based upon what we have provided already to ID.me
and I'll select a confirmation at the bottom there
at the checkbox and select continue
and here we'll select yes.
Now we are going to continue with the verification
via our phone
again, confirming our email address
for validation purposes.
Again, we're doing confirmations
and now waiting for ID.me
to do the final confirmation here
and we are authorizing ID.me to utilize
the information we have provided
as part of our ID validation.
We are waiting for CAIA
and here we're being told that
our email account
should receive a validation submission.
We are now in the SailPoint aspect of this demonstration.
The user was receiving an email address.
They selected the
URL to go into the G-Invoicing environment
and has been directed here
and we'll pursue these next steps.
So first we have to
configure our identity
by managing identity,
selecting Modify Manager.
Select set modify the manager for your account.
Select next.
There's no current valid manager set, so we must put
in an email address for our manager
(keyboard clicking)
and select next
and we can see
that the request was made successfully to our manager.
Once we receive actual validation,
we will receive an email.
Here, what we're doing
is we're choosing the environment
for the SailPoint roles
that we are going to request access for.
We check the boxes
of the pertinent applications and select Next.
We have successfully submitted.
We would then select ID.me
and then access G-Invoicing.
For further information on any of the contents
of this video or any G-Invoicing queries,
please reach out to your AIT representative
as listed below in the slide.
This slide displays
the Treasury Department G-Invoicing program team
noting Andrew Morris
as the program manager.
Also, please take note of the methods
to contact G-Invoicing Treasury team listed below.
For example, to contact
the Treasury G-Invoicing team directly,
use igt@fiscal.treasury.gov.
Thank you for watching this video.