NFRS Asset Management System - Functional Specification

⌘K
  2. Home
  4. Docs
  6. NFRS Asset Management Sys...
  8. Technical Specifications
  10. Security

Security

Overview: 

The Asset Management System for the Fire and Rescue Service will use Single Sign-On (SSO) with Azure Active Directory (Azure AD) to authenticate users. This approach streamlines the login process, enhances security, and provides a centralized authentication mechanism, making it easier for users to access the system with their existing organizational credentials. 

Steps Involved in User Authentication: 

  1. User Initiates Login:
    1. The user navigates to the Asset Management System’s login page and selects the option to sign in with their organizational account. 
  2. Redirect to Azure AD:
    1. The system redirects the user to the Azure AD login page. 
  3. User Enters Credentials:
    1. The user enters their organizational email and password on the Azure AD login page. Azure AD supports multi-factor authentication (MFA) if enabled, prompting the user to provide a second form of verification, such as a code sent to their mobile device or a biometric factor. 
  4. Azure AD Authentication:
    1. Azure AD verifies the user’s credentials and MFA (if applicable). If the credentials are correct, Azure AD generates an authentication token. 
  5. Token Exchange:
    1. Azure AD sends the authentication token back to the Asset Management System. The system receives the token and validates it. 
  6. Access Granted:
    1. Upon successful token validation, the Asset Management System grants the user access to the system. The user’s roles and permissions are checked against the system’s database to determine their access level and available functionalities. 

Components Involved: 

  • Azure Active Directory (Azure AD):
    • Provides a secure and scalable identity management service. It handles user credentials, multi-factor authentication, and generates authentication tokens. 
  • Authentication Middleware:
    • Integrated within the Asset Management System, this middleware handles the redirection to Azure AD, token validation, and user session management. 
  • Role-Based Access Control (RBAC):
    • Once authenticated, the user’s roles and permissions are enforced by the RBAC system within the Asset Management System, ensuring users can only access functionalities appropriate to their role. 

Benefits of Using SSO with Azure AD: 

  • Streamlined User Experience:
    • Users can access the Asset Management System using their existing organizational credentials without needing to remember separate usernames and passwords. 
  • Enhanced Security:
    • Azure AD supports advanced security features such as multi-factor authentication (MFA), conditional access policies, and anomaly detection, reducing the risk of unauthorized access. 
  • Centralized Identity Management:
    • IT administrators can manage user accounts, roles, and access policies centrally through Azure AD, simplifying user provisioning and de-provisioning. 
  • Compliance and Auditing:
    • Azure AD provides comprehensive logging and auditing capabilities, helping organizations meet compliance requirements and monitor access to critical systems. 
  • Scalability:
    • Azure AD can handle a large number of users and integrates seamlessly with various applications and services, ensuring scalability as the organization grows. 

Example Scenario: 

  1. Initial Setup:
    • The IT administrator configures the Asset Management System to use Azure AD for authentication. This involves registering the application with Azure AD and setting up the necessary permissions and redirect URLs. 
  2. User Login:
    • A firefighter accessing the system from their mobile device selects “Sign in with Azure AD.” They are redirected to the Azure AD login page, where they enter their organizational email and password. Azure AD prompts for MFA, and the user approves the login request on their mobile device. 
  3. Access Granted:
    • Azure AD authenticates the user and sends an authentication token to the Asset Management System. The system validates the token and checks the user’s roles and permissions, granting access to functionalities such as asset check-out/in, maintenance reporting, and inventory management. 
  4. Ongoing Session Management:
    • The user’s session is managed by the Asset Management System, allowing seamless access without repeated logins. The system periodically checks the validity of the authentication token to maintain security. 

By implementing Single Sign-On (SSO) with Azure AD, the Asset Management System provides a secure, user-friendly, and scalable authentication solution that aligns with the organizational infrastructure and enhances the overall user experience. 

How can we help?