NOAA Federated Identity Gateway (NFIG) Integration & Onboarding Guide

1. Executive Summary: What is NFIG?

The NOAA Federated Identity Gateway (NFIG) is an Enterprise Authentication Proxy jointly developed by NOAA OCIO and Fisheries OCIO. Driven by federal cybersecurity directives (including EO 14028), NFIG centralizes and secures authentication across public-facing and internal systems.

NFIG allows applications to use:

• Login.gov for non-NOAA workforce users (general public and commercial partners).
• ICAM SSO for the NOAA workforce.
• Both options through a single, standard OpenID Connect (OIDC) integration.

By transitioning away from legacy, rigid regional "wave" deployments, NFIG utilizes a flexible, single-application onboarding lifecycle that respects unique seasonal cycles, technical constraints, and user demographics.

---

2. Governance and Team Roles

Executing a successful authentication migration requires clear boundaries of responsibility:

• Application Delivery Teams (Technical/OCIO): Responsible for technical integration, configuring OIDC endpoints, developing UI alert frames, validating 15-minute inactivity timeouts, and executing database migrations to map profiles and purge local passwords.
• Program Owners (Mission/Non-Technical): Responsible for the mission context, managing communication campaigns (warning emails, physical mailers), mobilizing dockside support, and determining launch windows around seasonal fishing and business cycles.

---

3. The Onboarding Lifecycle

Phase 0: Prerequisite Global Portfolio Strategy

Before any direct technical integration begins, application portfolios are inventoried and grouped by Level of Effort (LOE). Program Owners select their target launch quarters, which are then validated by the Application Delivery Teams. These milestones are locked onto a central coordination board (Jira).

The 5-Stage Onboarding Roadmap

Technical engineering is deliberately decoupled from user communications to prevent bottlenecks:

1. Stage 1: Sandbox Setup:
   • Technical: Submit a CR-Form to the ICAM team (icam.id.team@noaa.gov) requiring a federal signature and indicating the required user base (Workforce, Non-Workforce, or Both). Configure OIDC Discovery.
   • Mission: Draft banner mockups and FAQs.
2. Stage 2: Staging & Integration Testing:
   • Technical: Deploy to a staging server. Validate strict session timeouts and correct parsing of custom claims.
   • Mission: 60-Day Warning emails are dispatched to active users.
3. Stage 3: Launch Prep & Change Control:
   • Technical: Register production domains and pass change review boards.
   • Mission: 30-Day Warning banners are activated directly on the application homepage.
4. Stage 4: Soft Launch (Dual-Login):
   • Technical: Deploy a split-login allowing voluntary Login.gov linking alongside legacy passwords.
   • Mission: Mobilize on-the-ground support and monitor registration metrics.
5. Stage 5: Going Direct & Cleanup:
   • Technical: Remove legacy logins entirely, enforce automated redirects to Login.gov/SSO, and archive legacy credential tables.
   • Mission: Distribute final direct-only transition guides.

---

4. OIDC Connection Details & Developer Notes (SDLC Track)

NFIG uses standard, stack-agnostic OIDC powered by AWS Cognito. No Cognito-specific custom code is required.

Data Exchange Requirements

• What you provide to NFIG: Callback URLs, Sign-out URLs, and OAuth Scopes (openid, email, profile).
• What NFIG provides to you: Cognito Client ID, Client Secret, and the OIDC Discovery Endpoint.

OIDC Discovery Endpoint

Use this endpoint to automatically discover all necessary NFIG routing and cryptographic keys, ensuring seamless security updates without manual code changes:

https://issuer-cognito-idp.us-east-1.amazonaws.com/us-east-1_jNNYN2LCz/.well-known/openid-configuration

Strict Implementation Requirements

• Authorization Code Grant: Must use response_type=code. Legacy flows (like Implicit grant) will be rejected.
• PKCE Support: Required. Send code_challenge and code_challenge_method=S256 on login, and verify with a code_verifier at the token endpoint.
• Client Authentication: Authenticate via HTTP Basic Auth (client_secret_basic) or request body (client_secret_post). Treat the Client Secret as a sensitive password.
• Session Timeout Compliance: Federal compliance requires applications to enforce a strict 15-minute inactivity timeout. This must be verified during Stage 2 pre-live staging.
• Custom Claim Prefixing: Upstream SAML attributes receive a custom: prefix. Applications should parse claims like custom:ial instead of ial.
• Legacy Data Purges: Following a successful launch, teams must execute database migrations to purge local password hashes and archive legacy user tables.
• Single Logout (SLO): Supported. Ensure the local application session is cleared before redirecting to the gateway's /logout endpoint.

---

5. Optimizing the Login Flow & User Outreach

Direct Routing (Bypassing the Default Gateway Screen)

By default, NFIG presents a provider selection screen (NOAA Workforce vs. Public/Login.gov). If your app targets a single audience, or you manage routing directly in your UI, you can skip this screen by appending an idp_identifier parameter to your /oauth2/authorize request:

• idp_identifier=NOAA-Users: Routes directly to the internal NOAA SSO.
• idp_identifier=Public-Users: Routes directly to Login.gov.

Modular Outreach Strategies

To prevent user lockouts, Program Owners can combine five modular outreach tools:

1. Dual-Login Landing Page: A split screen during Stage 4 allowing voluntary account linking at the user's convenience.
2. Flexible Timelines: Dynamic launch scheduling that explicitly avoids critical fishing seasons or regulatory deadlines.
3. Website Banner Alerts: High-visibility warnings placed on the app homepage 30 days before cutover.
4. Targeted Campaigns: Coordinated emails (60/30/15 days) combined with physical mailings for remote or offshore users.
5. In-Person Dockside Support: Mobilizing personnel (e.g., Port Coordinators) at harbors to assist users with lower digital literacy.

---

6. Support & Resources

• NOAA ICAM Team:
  • Email: icam.id.team@noaa.gov
  • Phone: (844) NOAAPKI
• Centralized Helpdesk: Recommended tier-1 triage node for common user account-linking questions.
• Google Chat Space: NOAA Fisheries has created a Chat Space for knowledge sharing and migration assistance (join via the provided internal link).