Sellafield Ltd | Optimising staff movement
The client
Sellafield has been nearly 80 years in the making. They are a pioneer for the UK’s nuclear industry, supporting national defence, generating electricity, and developing the ability to manage nuclear waste safely.
Sellafield is home to more than 200 nuclear facilities and has the most extensive inventory of untreated nuclear waste globally.
Their mission is nationally important, from cleaning up the country’s highest nuclear risks and hazards to safeguarding nuclear fuel, materials, and waste. Our client’s purpose is to keep Sellafield safe and secure.
The challenge
In February 2021, Condatis, Sellafield, and Digital Catapult started working on a Proof of Value (PoV) to explore how decentralised identity technology could expand Sellafield’s capabilities in managing employee identity credentials.
Condatis was tasked with developing a Nuclear Staff Passport, using verifiable credentials to enable highly skilled staff to quickly move between Sellafield’s 200 nuclear facilities. The staff passport needed to allow employees to provide verified records of essential training, certifications, and proof of clearance to carry out specialised work across the different sites.
The nuclear estate has its complexities. Managing and verifying personnel identity across the nuclear estate involves multiple partners, numerous reporting and issuing authorities requiring up-to-date training and security profiles, and a complex regulatory environment. A key area of interest was finding out how Sellafield could use distributed systems technologies to create a ‘Nuclear Passport’ allowing staff across the nuclear estate to securely and efficiently share identity credentials.
The verifiable credentials passport needed to:
- Act as an irrefutable skills ledger to track information such as radiological exposure and competencies, training, and facilities access.
- Give Sellafield’s workforce control over their identity data
- Give staff the ability to self-serve and move between facilities using their staff passport by providing evidence of their identity information and access clearance.
- Demonstrate that the benefits of the research are extendable to legacy operating environments and interoperable with existing systems.
The solution
Condatis built a bespoke verifiable credentials Nuclear Staff Passport platform for Sellafield over three configurations. The focus of the main objectives of the platform was to:
- Optimise Staff On-Boarding and Movement: offering opportunities to optimise staff on-boarding and minimise friction caused by staff moving between nuclear estate sites.
- Secure Credentials: cryptographically securing verifiable credentials helps establish a trust framework, which can be used between the 17 NDA (Nuclear Decommissioning Authority) sites and other organisations.
Split into three configurations outlined below, the PoV successfully demonstrated how verifiable credentials could be used within the nuclear industry to improve and enhance existing processes and drive digitisation.
Configuration one: improving staff movement and identification with distributed ledger technology
In the first iteration, Condatis focused on setting up and configuring environments to host our Nuclear Staff Passport and gateway system and a Microsoft Azure subscription dedicated to Sellafield. The gateway enables the issuance and verification of credentials and adheres to Microsoft’s Secure Development Lifecycle (SDLC) to ensure privacy and increase software reliability throughout development.
Issuing an employee credential to an employee’s digital wallet
With this configuration, employees can present their credentials to verify their employment details elsewhere in Sellafield and other organisations. As one of only six global partners worldwide selected for Microsoft Entra Verified ID consultancy, Condatis were given access to the closed beta version of Microsoft’s digital wallet functionality, built into Microsoft’s existing Authenticator app used for multi-factor authentication.
We developed a Staff Passport web application to allow Sellafield administration staff to locate employees and issue them with credentials by pulling employee information from Microsoft Azure Active Directory. Each employee profile contains their name, job title, email address, line manager, and a photo. The app also displays previously issued credentials as part of the employee profile.
In this first configuration, we also developed a Sellafield verifier web application that enables Sellafield’s administration staff to send a proof request, designed to require specific attributes for one or more credentials from the wallet holder, i.e., an employee. The proof request is initiated by the employee scanning a QR code with their Microsoft Authenticator app. The app then receives a request for the employee to share their credential attributes with Sellafield. The app allows employees to accept or reject proof requests. Upon accepting the request, the verifier will display all the requested credential attributes. The flow covers several user journeys within Sellafield, primarily when employees sign in to enter a building. Currently, building access is managed manually using a sign-in sheet. Verifiable credentials enable a digitised process that rapidly verifies the data source is trustworthy.
Configuration two: security, interoperability, process streamlining and ease of access
Configuration two focused on delivering additional credentials and proof request a separate Nuclear Decommissioning Authority (NDA) verifier was integrated.
We configured a new “Security Gate” proof request to require a subset of attributes from the employee training credential to address the use case of an employee arriving at a security gate. A security guard at the gate does not need to know all the employee’s information, such as their phone number; they only need to verify that the person at the gate is an employee and has clearance to access the site. Similar to wearing a clearance pass, the employee’s credential attributes are displayed to the security guard, who can then grant them access to the site.
All Sellafield employees are required to obtain security clearance from the Ministry of Defence vetting service. For the PoV, a mock “Ministry of Security” staff passport issuer was created to demonstrate how security clearance credentials can be issued to employees by a government organisation. Employees can present this credential for verification to prove to Sellafield that they have the appropriate security clearance.
Throughout their employment journey, staff gather credentials from multiple organisations and sources. This configuration demonstrates the technology’s ability to tie in credentials from verified external sources for employees to present them for verification when required. Sellafield employees can share their credential information (e.g., Employee or Security Clearance) with the NDA, allowing employees from Sellafield to visit and access NDA sites across the UK.
As part of this implementation, we created a ‘Trusted Issuer’ list so that only credentials issued by trusted organisations such as Sellafield would be accepted across the nuclear estate. This prevents bad actors from issuing credentials to themselves and gaining unpermitted access to the site.
Training credentials
Sellafield has around 6,000 different training qualifications, and in addition to qualifications, Sellafield needs to assess if employees are Suitably Qualified and Experienced Persons (SQEP). There are approximately 600 SQEP roles, a combination of qualifications and duties that prove that an employee can do a specific job, e.g., Electrical Engineer. Administration staff carry out annual checks to ensure that employees are sufficiently ‘SQEP’d’ to carry out their current responsibilities. This annual assessment is currently done manually and involves numerous spreadsheets and meetings to complete the evaluation. For employees, many may not know if their training qualifications are still valid, and it wasn’t easy for them to check.
We configured the credentials using the Open Badge standard (widely used for qualifications and training certificates). Each credential contains the qualification title, code, description, and expiry date and the Sellafield verifier app was able to verify each training credential individually.
So, what about expired credentials? We developed logic to display a message on the verifier when an expired credential was presented alongside the credential attributes. This informs the user carrying out the verification that the employee’s credential has expired.
Configuration three: verifying SQEP status using distributed ledger technology
In this final project iteration, we take a deeper look at SQEP verifications. The iteration included new functionality such as handling SQEP verifications, radiation dosage credentials, and credential revocation. The six training credentials added in configuration two make up the “Sellafield Fundamentals” SQEP role.
All new staff that join Sellafield are required to complete these courses via an online training system. When the employee scans the QR with their digital wallet during verification, they will receive a proof request in their app asking them to share attributes from all six credentials. If the employee does not have one of the required training credentials, they will not satisfy the proof request. Upon successful verification, the credential attributes are displayed in the verifier app.
Tracking employee radiation dosage at work
If an employee exceeds safe dosage limits, they cannot perform specific jobs or access certain parts of the site. We developed a dosage credential that contains an employee’s current dosage level in Millisieverts. Upon verification, checks are made to ensure the dosage is below 15 millisieverts. If the dosage is exceeded, an error message is displayed to the verifier.
The current process to verify SQEP status is time-consuming and expensive. The ability to verify information from multiple credentials at once is invaluable, especially since SQEP roles are often complex and need to be regularly evaluated. The key benefits realised in this iteration were security, process streamlining and ease of access.
The benefits
From securely tracking and monitoring high-value assets to ensuring the safety of the workforce on site, the range of benefits that distributed ledger technologies can bring to the nuclear industry is vast.
The Nuclear Staff Passport provides Sellafield with:
- The ability to issue employee credentials
- The ability to integrate with Microsoft Authenticator digital wallet
- An irrefutable record of security clearance and training credentials
- A simpler and effective way to verify Suitably Qualified and Experienced Persons (SQEP)
The Proof of Value highlighted the following key benefits:
- Staff movement and ID – decentralised identity allows employees to present their identity credentials easily and securely.
- Security – decentralised technology offers an approximate 90% reduction in potential risk for a data breach. Sensitive personal data is cryptographically stored on the users device.
- Process Streamlining – issuing credentials can take anywhere between 3 weeks to 3 minutes. It is estimated that by implementing a verifiable credentials solution, Sellafield reduces time to on-board and offboard staff by approximately 80%. Enabling verification of SQEP status to happen instantly, ensuring the employee is sufficiently qualified.
- Traceability – A history of all issued credentials is maintained.
- Ease of access – A decentralised system empowers the right people in organisations to set, enforce and execute complex data sharing policies across enterprise boundaries. The system offers a reduction in the need for paper-based systems, reducing costs across the estate.
Royal Melbourne Institute of Technology | Enhancing student experiences with Microsoft Entra Verified ID
The client
Our client, The Royal Melbourne Institute of Technology (RMIT), is a public research university in Melbourne, Australia. RMIT is leading the way in higher education, shaping the lives of 95,000 students globally. RMIT is recognised for their strong programmes in Art and Design, Architecture, Engineering, Computer Science, and Information Systems, to name a few. Our client is dedicated to innovation and industry opportunities, and more recently, have widened their focus to implement developments globally.
The challenge
We engaged with RMIT and Microsoft to carry out a Proof of Value (PoV) to facilitate a smoother onboarding of students and provide an enhanced student experience. Our client required the following main changes; RMIT wanted student identification credentials stored in the Microsoft Authenticator App as part of the process of their 1st Azure AD login; To have student identification to verify discounts on campus, with the discounts to be used as an incentive to students to load their credential into the authenticator app; As well as this, they wanted Student training records and printing of certificates, and finally Alumni transcript issuing as part of employee onboarding.
As part of the PoV, Condatis were required to demonstrate three specific user journeys: issuing student cards; completion of training, verification and printing certificates; issuing and verifying alumni transcripts to onboard alumni as new employees.
The solution
Using the Microsoft Entra Verified ID technology stack, Condatis initiated and delivered three user journeys.
The first user journey: a student card being issued digitally through an Azure Active Directory login.
To incentivise students into verifying their identity, they received a discount upon verification. This solution allowed students to prove their university status for discounts at several campus locations such as the cafeteria or RMIT bookstore.
The second user journey: a student completes training and verifies to print their certificate.
This user journey met RMIT’s aim to demonstrate module attainment and other qualifications offered by the University. This journey allows students to add their qualifications to a digital wallet for verification.
The third and final user journey: issuing alumni transcripts and verifying as part of employee onboarding.
This solution eliminated the common challenge faced in the industry – verifying alumni students after graduating from RMIT. As such, the final user journey permits non-enrolled former students to provide a verified status for them to access transcripts, improving employability, allowing students to exchange verified qualifications with new employers easily.
Benefits
Our three-step PoV provided value in several ways for RMIT:
- Verifiable credentials are cryptographically secure, enabling RMIT to build trust with their partners and employees.
- Students hold and self-manage the distribution of their data. Verifiers request only the information they need, and the students decide whether to provide it.
- Cost savings: support and maintenance costs are reduced.
- Ability to identify students in a widely distributed campus without the need for new or complex IT infrastructure. RMIT can integrate verifiable credentials technology into existing systems and processes.
- Speed of onboarding was a significant benefit of the project. Previously this took days and will now potentially take seconds, making this a high administrative cost and time-saving.
- Sustainability targets: removal of the need to issue plastic identity cards help RMIT reach sustainability targets.
- Self-managed privacy, students decide what information about themselves to supply and when.
- Students receive discounts and offers through proof of status.
- Students can retrieve and print official documentation, including their academic records, on-demand.
- Digitally verify qualifications as part of new employee onboarding.
- Build a trust framework between the University, students, partners, and employers as students move from learning into employment.
Get more content like this straight to your inbox
Please leave your details below to subscribe and receive case studies, news, and exclusive invitations to events.
Get in touch
NHS | Rapid frontline staff deployment with the Digital Staff Passport
The client
NHSX is a joint unit of National Health Service (NHS) England and the Department of Health and Social Care, supporting local NHS and care organisations to digitise their services. NHSX supports over 300 NHS Trusts, serving local populations to connect health and social care systems, transforming how the NHS delivers patient care at home, in the community, and hospitals. NHSX sets the overall strategy for digital transformation across all NHS Trusts, negotiating national contracts, designing the entire NHS system architecture linked across health and care, and setting the national policy delivering change.
The challenge
The NHS has an incredibly complex multi-organisational structure with separate NHS Trusts serving communities across every region of the United Kingdom. Healthcare staff are employed by an NHS Trust in a particular region. During times of high healthcare demands, staff may temporarily relocate to support another region and NHS Trust in the UK. To do this, staff must re-prove their identification, medical certifications and undergo a laborious paper-based onboarding process every time they need to move between clinics and regions. The entire process can take anywhere up to seven days to onboard staff.
In July 2019, as part of a digital strategy, NHSX set out their ‘People Plan’ to streamline processes and reduce duplication. The plan focused on continuous development and training that health professionals need to do throughout their careers. The objective was to enable easy data exchanges from one NHS Trust to another using a decentralized Digital Staff Passport (DSP) that healthcare professionals would own and have control over. The data would cover existing staff attributes such as employment history, qualifications, endorsements, vetting and training.
While this project was to take place over a few years, the sudden impact of the COVID-19 pandemic accelerated timescales, and the NHS needed to have the product ready within weeks. The old onboarding process was inefficient. It would take weeks for staff members to register in a hospital; HR needed to validate their university degree, check that all required training was completed, and have the right to work in the UK. HR and administration staff must repeat this onboarding process every time a staff member starts work at a different NHS Trust. This process leads to slow onboarding, high use of agency workers, frustration for staff and high levels of administration.
Developing and implementing the DSP came with challenges around data security and interoperability. The NHS needed to be sure that a person using the DSP was allowed to work to avoid the wrong or underqualified individuals getting access to patient data or working with patients without having the right medical skills. The project looked at the challenges in issuing these passports, looking at integration points between HR systems and issuing systems to speed up the process. The project also tested how the NHS could use the DSP to log into clinical and workforce or staff bank systems and evaluated the effect on the induction processes for the healthcare professional.
The digital footprint of a healthcare professional is complex. It starts with training in a medical school and a degree being awarded to them. Healthcare professionals need to be registered with their relevant professional body to obtain their licence to practice. They also need to prove current or previous employment status to access the appropriate systems which they use daily.
Healthcare professionals must undergo Disclosure and Barring Service (DBS) and Right to Work checks – these are vetting processes and need to be recorded. Moreover, a healthcare professional has a continuous professional development program, and all of these training and development awards make up their digital life footprint.
As more newly employed staff members might need remote onboarding, these attributes also need to be bound to an assured digital identity that binds the presenting wallet holder to a real live person and fulfils all the evidence of a digital identity.
The solution
The DSP is built on decentralised technology and enables healthcare workers to control how their identity details are used and stored. With the DSP, a healthcare professional’s data is held cryptographically on their mobile device using Connect.Me, Evernym’s digital wallet. The technology streamlines existing NHS HR processes allowing departments to issue verifiable credentials that certify their identity, qualifications, and training records. Sitekit and Condatis’ verifier app integrates Connect.Me with the NHS’s HR system. The technology significantly improves the HR process and allows the NHS to rapidly deploy staff to where they’re needed most, without unnecessary bureaucracy.
The benefits
The implementation of the DSP system is based on Microsoft Azure, and each issuing organisation has its issuing and verification portal hosted in Azure. It was built using architectural infrastructure stamps and allowed a rapid rollout to now nearly 100 NHS Trusts. Authentication to the issuing and verifying portal reused existing NHS login mechanisms. The authentication using decentralized identity was also tested as an authentication method for the verification portal. This enabled non-NHS employees to use the verifier, reducing overheads and the security downfalls of setting up new usernames and passwords.
“Our work with verifiable credentials enables us to envisage solutions to major problems within the workforce and beyond. It enhances the user experience with modern digital methods, which wouldn’t be possible without verifiable credentials. The NHS’s Digital Staff Passport program, starting with staff movement in the COVID-19 pandemic, will streamline lots of otherwise manual, time-consuming, and expensive ways of working. Overall, this will improve staff mobility and increase efficiency, which will provide many cost-saving benefits essential to an organisation the size of the NHS.“
– Phillip Graham, Digital Programme Director at Blackpool Teaching Hospital
Digital Staff Passport key highlights
- W3C standards-based architecture
- Simplifies staff movement between NHS organisations
- Saves time by providing a portable and verified record of identity and employment. The DSP offers a cryptographically secure way of storing this information that previously the healthcare professional had to gather manually in paper form or get up to date issued by their training providers or employers.
- The DSP simplifies data sharing and consent. NHS organisations need to have data sharing agreements in place. As the user holds the data, they can provide direct permission to access and verify the data.
- The system provides more efficient use of health professionals’ time and skills, enabling them to work when and where they are most needed.
- The NHS has a digital solution that saves lives. Approximately 100 army personnel with credentials were issued to help aid vaccination centres during the pandemic. There is no price tag to put on that benefit, and we are proud to have been able to support the NHS during such trying times.
The partners
Condatis
Condatis is a leader for bespoke external identity solutions. We are a Microsoft Gold Partner specialising in Azure Active Directory B2C and Verifiable Credentials. Condatis delivers employee, customer, and partner identity solutions to drive growth, reduce friction and improve security.
Our clients work with us to facilitate innovation in identity and build safe digital transactions. We have a track record of developing, designing, implementing, and supporting solutions at each stage of an organisation’s external identity journey.
More Case Studies
Sitekit Group
Sitekit Group delivers enterprise-grade digital transformation solutions for the public and private sectors. Sitekit has a strong footprint in healthcare, working to deliver digital transformation for the NHS and build a health and care system that is integrated, secure and built around individuals and their needs.
Find out more about Sitekit
Microsoft
Microsoft Identity team works on the most challenging engineering problems, solving issues that nobody has solved before. Serving over a billion users, the team runs a service that is critical to the day-to-day experience of every Microsoft Cloud user.
Find out more about Microsoft’s Identity Engineering Team
Evernym
Evernym was founded in 2013 to solve the digital identity crisis. We envisioned a world where consumers are in complete control of their digital identity, where privacy is a basic human right, and where consumers and organizations can foster a new relationship rooted in trust. And today, eight years later, we’re at the forefront of a rapidly growing global movement to decentralize digital identity.
Find out more about Evernym
Get in touch
Financial Services | Modernising Customer Identity
The Client
Our client is an FTSE 100 global investment management organisation headquartered in the City of London. It invests and manages over £350 billion in assets on behalf of clients including equities, fixed income, and real estate.
Our client’s vision is to become the best-loved and most successful savings and investments business. Their purpose is to help people manage and grow their savings so they can live the life they want while making the world a little better along the way.
The Challenge
Our client was looking to modernise their customer identity system – their digital front door to the business – with key requirements for high-level security and an excellent customer experience. Customer growth and retention were key business drivers for change. Through a new and improved identity and access management (IAM) solution, their customers will have a simpler and more secure way to access their services and accounts.
The Solution
Through a Proof of Concept (PoC), Condatis demonstrated that Microsoft Azure AD B2C could meet all of our client’s requirements and desired use cases, including:
Progressive profiling
Progressive profiling is a technique for gradually building up a profile of your customers each time they interact with your product. For this client, this functionality will allow them to keep questionnaires and forms short and increase landing page conversion rates whilst also providing security insights and enhancements.
User Migration
Our client wanted to be sure that any new Customer Identity and Access Management (CIAM) service could securely consume existing customer identities from legacy data stores. User migration to the new service should also have the flexibility to be completed either in bulk (all at once, usually during a quiet time outside of normal working hours) or just-in-time as and when a customer signs in using the new service for the first time, transitioning seamlessly for the customer.
Fraud management, analytics, and reporting
Security and fraud prevention along with telemetry for monitoring and reporting is essential for our client. For this use case we configured and demonstrated the capabilities of Azure AD B2C and its capacity to surface insights into Microsoft Azure Sentinel (a scalable, cloud-native, security information event management (SIEM) tool.
This functionality also allows our client to automatically track and review the risk of attempted login by geographical location, using conditional access rules to apply additional security steps when necessary.
Federated Single Sign-On (SSO)
In this use case, we demonstrated the ability for Azure AD B2C to federated into multiple client applications using standards-based authentication including OIDC, SAML 2.0 and OAUTH 2.0.
Additionally, the ability for Azure AD B2C to leverage external identity providers including integrated software vendors (ISVs e.g., Experian) and multifactor authentication providers (MFA, e.g. Twilio) was also included.
Forgotten Password Journey
This final use case focused on the forgotten password journey – a user flow that is often frustrating for users and a target for bad actors.
The PoC demonstrated that with Azure AD B2C the user can quickly and easily reset a forgotten password, ensuring the correct password strength is adhered to and MFA is utilised to ensure the correct level of assurance is obtained during the process. Additionally, it was demonstrated how a user might also easily change their password when already logged into the service.
The Outcome
The proof of concept and demonstration delivered by Condatis helped our client validate Azure AD B2C meets all the requirements listed against their key use cases. This assurance and insight of further flexibility and wider integration into other Azure and external services provided our client with the confidence to select Microsoft Azure as the technology platform of choice for customer identity and access management.
Features
- Client-side SDK for API based integration
- API based support for CIAM functionality
- Progressive profiling capabilities
- Password policies
- Fraud management for user risk assessment
- Device fingerprinting
- Identify proofing and verification
- MFA
- Consent management
- Integration capabilities
Get in touch
Financial Services | Transforming Customer Identity
Building a universal identity platform
We recently engaged with a global insurance provider to transform their customer identity services by building a universal identity platform. This single credential solution streamlines access to several of our client’s digital services, giving their customers the ability to self-serve.
The Client
Our client provides health and care services to millions of people worldwide with first-rate digital delivery supporting these services. Our client articulated their vision to deliver a universal platform that enables quick and simple access to digital services for all its users to achieve consolidation and continuity across geographies and services.
The Challenge
To have a single credential that all customer-facing apps could use on a universal identity platform, our client brought us on board to design and implement a single credential solution. The new system needed to allow their customers to have visibility into their existing insurance policies, provide flexibility for customers to upgrade and control their policies without requiring assistance from the customer support team.
The Solution
Built using Microsoft Azure AD B2C Identity Experience Framework (IEF), we designed a new and improved identity platform allowing customers to self-serve, manage their user profiles, and upgrade their accounts and membership schemes. Our client’s new system gives their customers the control and ability to access additional services. The platform allows users to login, register, and self-manage their profile, giving customers control over their membership types. Depending on a customer’s membership, users can login with an existing identity credential from their member portal. Users will not be required to create a new account for each service and can easily switch between membership schemes.
The identity platform gives our client the flexibility to control their digital transformation by allowing their global teams to deploy digital services independently of one another, allowing them to tailor the services offered through the on-boarding of Relying Parties whilst controlling access to sensitive personal data.
Benefits
This universal identity platform is a robust and scalable solution that allows our clients’ customers and staff to:
- Consolidate global services around a single centrally managed identity.
- Use a globally available system that scales as demand changes.
- On-board additional regions, individually, as digital transformation gathers pace within the organisation.
- Self-serve and manage profiles globally.
- Have common access journeys to our client’s digital services through on-boarding Relying Parties and using SSO to access them.
- Use existing login details from previous digital services and their member portal to access the platform.
- Sign up quickly and securely through a globally accessible registration system.
- Deploy localised services using the platform’s support for language and customised branding variations within journeys.
- Manage GDPR and Legal notices associated with the system.
- Define a security model that supports levels of assurance and evaluating permissions through multifactor authentication.
- Audit system events (such as storage, event, and telemetry) through a resilient dual service bus architecture.
- Migrates users ‘just in time’ rather than performing a complex bulk migration operation.
- Monitor infrastructure component availability and recent error events through regional support dashboards built from ARM templates.
- Support for Customer Service Representation (CSR) through a secure administration app, allowing profile management to be handled on behalf of the user if required.
Our client now has an identity system that they can easily upscale as the business offers more digital services in the future.
Get in touch
UK Hydrographic Office | MGIA Customer Identity
The Client
The UK Hydrographic Office (UKHO) is a world-leading centre for hydrography, specialising in marine geospatial data that helps others to unlock a deeper understanding of the world’s oceans.
Working with a wide range of partners, UKHO source, process and provide access to this data, ranging from seabed to surface. This is key to helping others make the best use of our oceans in safer, more secure and more sustainable ways.
UKHO offers a portfolio of services to government, private sector, and the public. Through the ADMIRALTY Marine Data Portal and API Manager, UKHO helps people make use of oceans safely and sustainably.
The ADMIRALTY Marine Data Portal provides people and organisations with a wide range of data sets from wrecks, obstructions, seabed composition and much more. The API Manager service allows UKHO to use ocean data in third-party apps.
The Challenge
Paper charts were a high-revenue stream for UKHO. With the demand to move to digital, the organisation needed to ensure that their digitised maps and data services would retain the same high value.
Condatis was brought on-board to implement a digital front door to ADMIRALTY Marine Data Portal and API Manager, integrating seamlessly with Dynamics 365 to support customer management.
The Solution
Working closely with technical staff at UKHO, Condatis developed an identity platform that demonstrates how Microsoft Azure AD B2C can be used to provide a single identity across internal and third-party systems.
The new platform builds on Azure AD B2C’s infrastructure and services to offer custom user journeys and policies. This is particularly important because of the wide range of systems at UKHO.
The solution distinguishes between the two user types (customer or staff) and automatically directs people to the right pages. Customers see a branded, user-friendly account registration/ sign-in page, and staff members are asked for their Active Directory (AD) credentials.
The Benefits
Through the development of custom user journeys using Azure AD B2C, UKHO’s different systems can be accessed using Single Sign On (SSO).
Having easy, secure access to charts modernises the customer experience and enables UKHO to grow out its digital services.
Condatis successfully created a solution that enables:
- A secure front-door to digital services
- Azure AD B2C enabled Single Sign On (SSO) across different systems, improving ease of access, and protecting UKHO Intellectual Property (IP)
- An identity platform that is re-usable across UKHO, providing opportunities to maximise investment and achieve a Return On Investment (ROI)
- Custom user journeys for users dependent on their user type, with custom branding
- Customers to have the ability to self-manage their account, reducing the burden on UKHO support teams
Get in touch
Logistics | Orchestrating Authentication Journeys
The Client
Our client is one of the world’s largest providers of integrated shipping services, providing broking, finance, support and research across all shipping and offshore sectors.
The Challenge
Our client has set six strategic objectives to create long-term sustainable value for its stakeholders. At the core of these objectives lies trust. To maintain trust, it needed to improve the security of its web platform by adding a secure, robust and flexible authentication service.
This service needed to allow employees, customers and other corporate users to use single sign-on (SSO), whilst improving the security of the service by offering multi-factor authentication (MFA).
It was important that new functionality would be cloud-based, yet work seamlessly with existing systems, without affecting their functionality.
In addition, the client’s own teams needed to be able to implement and maintain the new authentication service without third-party support.
The Solution
Working closely with the client’s technical team, Condatis produced a Proof of Concept (PoC) illustrating how Microsoft Azure AD B2C, integrated with existing web pages, can be used to orchestrate authentication journeys. To enable multifactor authentication, Condatis used provider Duo (duo.com), which determines the user type and matching Identity Provider (IdP). Azure AD B2C then returns the required access token to the relying party application. Condatis demonstrated the PoC authentication functionality and documented the solution to enable the client to easily and securely implement the service.
The Benefits
- Our client manages big system migration projects. This solution demonstrated that the authentication aspect of these projects can be dealt with separately in AAD B2C, without interfering with running development or migration projects.
- The PoC proved that third-party services such as Duo can easily be configured and integrated with their authentication journeys.
- The solution was handed over in full to the client’s technical team, giving them the technical details, knowledge and confidence to maintain and extend the system. The PoC allowed the client to get a low-cost insight into the potential of the AAD B2C authentication service, before committing to a fully funded project.
Get in touch
Scottish Government | Identity Alpha
The Client
Digital Identity Scotland Programme Board oversees the programme governance for the delivery of the Scottish Government Online Identity Assurance Programme Plan, which sets out the actions to deliver the Scottish Government Digital Strategy commitment to work with stakeholders, privacy interests and members of the public to develop a robust, secure and trustworthy mechanism by which an individual member of the public can demonstrate their identity online (to access public sector digital services).
The Scottish Government Digital Identity Scotland Programme Board has the remit to deliver:
“A robust, secure and trustworthy mechanism by which an individual member of the public can demonstrate their identity online”
In support of this aim, Scottish Government engaged several partners to deliver PoC (Proof of Concept) digital identity functionality to enable assessment of modern technologies vis-à-vis their suitability for deployment at scale, across public services and for all citizens of Scotland.
The Challenge
From a citizen’s perspective, being able to utilise an existing digital identity to conduct their business in a digital world is very important. A digital identity makes the individual more productive online allowing both control over who receives their personal data in addition to making the provision of their personal data to a service much more effective and secure.
In parallel, service providers, such as Social Security Scotland, need to have confidence in the identity of the citizen accessing their services balanced with a seamless and productive user experience.
Service providers need to able to efficiently onboard to an identity assurance service with a single technical connection giving access to multiple identity providers (IdPs) and receiving responses from identity providers converted into a standard format for easy consumption.
The Solution
Condatis led the delivery of the underlying digital identity platform – an integration layer that enables rapid and straightforward “wiring-up” of digital services with identity providers and thereby providing service access to citizens.
The integration layer demonstrates how citizens can assert their identity to Scottish Government and Local Authority Services using a digital identity created through their Identity Provider.
As a straw man, Condatis identified six types of user journey for consideration as part of the POC, including two where a citizen initially uses a social media identity (Facebook, Google, Microsoft) to access digital government services. For the POC, the social media digital identities would be uplifted to establish a higher level of assurance by using a manual Vouching service, whereby the citizen elects to attend a physical location to present physical identity evidence.
Condatis’ PoC actually demonstrated the following use-cases:
- User signs-in to North Lanarkshire demonstration application with their myaccount identity
- User signs-in to North Lanarkshire demonstration application with their Post Office identity
- User signs-in to Social Security demonstration application with their myaccount identity
- User signs-in to Condatis third party test harness with their myaccount identity
- User sign-in to Condatis third party test harness with their Post Office identity
Achievement of these use-cases also showing:
- Ease of integration and interoperability with digital public services (relying party applications):
- Scottish Social Security
- North Lanarkshire Council
- Ease of integration and interoperability with digital identity providers:
- myaccount
- Post Office
- Suitability of Microsoft Azure cloud technology, demonstrating:
- Value for money
- Ease of set-up and configuration
- Security and resilience
- Ability to scale
Based upon the output from the Discovery project, Condatis proposed to create a series of authentication journeys on Microsoft Azure’s AD B2C cloud identity service.
The Benefits
Through the identity capacity of Microsoft Azure AD B2C:
- Users can take advantage of the ability to ‘Bring Your Own Identity’, whereby an existing digital identity can be used to allow the user to assert their identity to Scottish Government.
- Users can be provided with a ‘Scottish Government Digital Identity’, whereby the user chooses to uplift their social media identity and create a new account appropriate to the required level of assurance.
- Users can uplift their level of assurance by utilising a Vouching service, where a user presents physical evidence in a face-to-face appointment with a government official.
- Users can use the uplifted level of assurance to satisfy the service providers requirements as the Relying Party (RP).
- The Scottish Government would support the provision of attributes to the RP with the user’s express consent where these attributes could be source from the use’s IDP, personal data store or other third-party sources.
The full findings of the Alpha project were captured in an OIX whitepaper.