Easy Access

Nelson Martinez Jr. used to hate Monday mornings. As systems support manager for the city of Miami Beach, Fla., he is charged with ensuring that IT efficiently supports the city’s government offices as well as its public-safety officers. And each Monday, his help desk was inundated with calls for password resets.

But these days, Monday mornings are quiet. Just over two years ago, Martinez implemented Imprivata’s OneSign single sign-on (SSO) appliance, which, in addition to providing law enforcement and government employees with access to the city’s various applications and data stores through a single ID and password, also includes a self-service password-reset function.

“Before, we were getting 50 calls every Monday, and now it’s gone down to maybe two or three, if that,” he says. “It’s a nice change.”

Simplified Sign-on

More state and local law enforcement agencies are implementing SSO as it matures and the benefits become more concrete. In the past, SSO solutions were complex and difficult to integrate, but options like Imprivata’s appliance are now easing SSO rollouts.

Imprivata’s OneSign is a hardened appliance with a Linux-based OS that integrates with the city’s Active Directory (AD) directory service to enable employees to use just one ID and password to access a variety of back-end applications and data stores. It can also handle access to legacy, non-AD applications by using profiles developed in house.

“Being in government, we like to get the most ROI we can, and we still have our share of legacy applications,” Martinez says. “And unfortunately, with legacy apps, some of them have internal built-in ID authentication that doesn’t really integrate with a directory service like Active Directory.”

To include legacy applications in the SSO solution, Martinez uses a wizard within Imprivata to build a profile for each app that includes parameters such as the look of the login screen, where on the screen the ID and password are entered, what they look like and what screens a successful login generates. The next time users try that application, they enter their user ID and password, but Imprivata captures that information.

“The minute they put in their ID and password, the Imprivata agent associates it with them, so the next time they crank it up, it automatically provides the user ID and password,” Martinez says. “And they don’t have to put anything in there again.”

The result is that Miami Beach’s law enforcement community is far more efficient. “The less time it takes for us to log in or do password resets for public safety, the more time they can spend inside their vehicles doing productive work,” Martinez explains. “And that benefits the whole community.”

Active Directory Approach

Like Miami Beach, law enforcement agencies within the state of Alabama also were finding that password management for its various back-end data stores and applications was getting out of hand.

“We had multiple tools out there that weren’t getting used because it would take officers too long to log in,” says Shane Hammett, senior project manager for the Alabama Criminal Justice Information Center (ACJIC). “Plus, there were multiple passwords, people were constantly calling that they’d forgotten their password, and expiration of passwords on all these applications were at different times. It got to be very complicated, and we knew we had to address that.”

At the time, appliance-based solutions like Imprivata were not commonplace. So the team at ACJIC implemented a homegrown SSO solution as part of the AlaCOP.gov web portal. The .NET application, called the Active Directory Authentication Processing Tool (ADAPT), acts as a generic front end to the various applications and data stores accessed through the portal. ADAPT integrates with AD in the background so that once a user logs into the portal, ADAPT checks his AD credentials and automatically provides him with the correct rights and privileges.

“This allows law enforcement to access as many different data stores as possible, everything from driver’s license information to criminal history to office of the courts documentation, warrants and sex offender data stores,” Hammett says. As a result, this has significantly reduced support costs.

The key, Hammett says, is to ensure the gateway SSO access application is as generic as possible. “It’s homegrown, but we’ve done it in such a generic way that it’s not been too costly to implement, and every time we need to add a new application, it’s pretty straightforward for the vendor to adapt to it.”

He is working on extending the SSO solution to enable access to data stores outside the state’s borders. “It’s a policy challenge, not an SSO or technology challenge,” he says.