Repository navigation
Migrating UGRC apps off of Forgerock #880
Description
Benefit
DTS is in the process of migrating existing on-prem authentication to either EntraID (for internal user-base authentication) or PingOne Identity Cloud/IDC (for external user-base authentication). Overall, the goal of this project is to migrate all apps using legacy UtahID/OpenAM by June 30th, 2026.
These migration efforts are for the authentication aspect of the applications only. An ApAdmin/AppProfile 2.0 is in the works - those applications will be saved for the end of phase 1 as the replacement is a dependency for them.
Acceptance Criteria
- Update our list of UGRC apps in ServiceNow: Business Applications and identify the authentication used for each, specifically those that are using UtahID - OpenID Connect.
- Fill out a SSO Migration Project: Single Sign-On (SSO) Request Form for all impacted UGRC apps (Bri will be helping with this)
- Build a POC to determine compatibility and level of effort
Apps to migrate
| Project | Needs Group Management | Request Ping Creds | Received Ping Creds | Dev Migrated | Prod Migrated |
|---|---|---|---|---|---|
| parole | ✅ | ✅ | ✅ | ||
| plss.utah.gov | ⛔ | ✅ | ✅ | ✅ | ✅ |
| plss-review.utah.gov | ✅ | ✅ | ✅ | ✅ | ✅ |
| UIC | ⛔ (roles come from app db) | ||||
| roadkill | ⛔ | ||||
| developer.mapserv.utah.gov | ⛔ | ✅ | ✅ | ✅ | ✅ |
| electrofishing | ✅ | ||||
| electrofishing-query (uses the same client as electrofishing above) | ✅ | ||||
| moonwalk | ⛔ (uses authorize-users firestore collection) | ||||
| TURN GPS Billpay | ⛔ |
Notes
- Bill any work to the following project for FY27: PRJTASK0709389 - ApAdmin Auth Migration
- Bri Lifferth is heading up this project on the DTS side and is our point of contact for questions.
- Application Migrations to Entra/Forgerock IDC Slide Deck
- Authentication Migration Process Flow (Step 5 is a crucial steps that many migrations have missed)
- FY27 App Authentication Migration FAQs
- Identity Cloud - OpenID Connect wiki
- Scopes and Claims
⚠️ For EntraID, employee_id is a custom attribute that must be requested on an app-by-app basis.
- UGRC's preference is to migrate all apps to PingOne, even if they are internal only
- UGRC-specific Migration Steps
Risks
- This was brought to the attention of UGRC in January 2026. Devs are currently at capacity for FY26 Q3, with a major focus on meeting Website Accessibility standards by the Federal deadline of April 26, 2026. We may not be able to put forth a major effort into this migration until FY26 Q4, which greatly shortens the timeline.
- Compatibility with UGRC Firebase OIDC apps is still an unknown
Activity
jacobdadams commentedon Jan 23, 2026
I don't think I've got anything worthwhile to add/work on for this project- none of the scripts I've written use any user authentication.
steveoh commentedon Jan 29, 2026
FY26 Q3 Sprint 3 Notes
I’m working with Dave Crim and Brandon Thomas on the Google Identity Platform (IdP) integration with PingOne.
I successfully validated the app and Firebase setup using Entra credentials, but I am currently troubleshooting issues with Ping. This is the solution we need for our mixed user audience.
You can view the POC at https://plss.dev.utah.gov/, which now allows you to choose different login providers. Note that because we aren't merging accounts, existing UtahID users will trigger an account-exists error. This confirms the credentials work, but you will need to delete the user in Firebase/Firestore to clear the error.
stdavis commentedon Feb 18, 2026
Steve got the POC working this morning. I think that we have a fairly good plan of how to move forward with this. Does anyone have a list of the apps that need to be migrated? Here is what I came up with:
I'm not sure what these two apps are in apadmin:
chriswnek commentedon Feb 19, 2026
@stdavis Comparing your list to the spreadsheet that we were working on with Bri, this is the one that is missing DTS-UGRC-TURN GPS Network - Payment Gateway (Utah Interactive). It's listed separately from TurnGPS Bill Pay, and I'm not sure of how much it differs.
The other two apps in apadmin, not sure about Esri, but IbisphView is a DHHS application and I have no idea why it would be showing up for you. I can ask about it if you'd like, and have your access to it removed.
stdavis commentedon Feb 19, 2026
It's not a big deal since ApAdmin is going away anyways.
17 remaining items
stdavis commentedon Aug 26, 2026
I migrated https://plss-review.dev.utah.gov to Ping just now. It seems to be working for me. I'll start working on the production version once the IAM team gives me the user keys for it.
stdavis commentedon Aug 26, 2026
Sent user lists for prod plss and plss-review to the IAM team today (REQ0387463)
chriswnek commentedon Aug 27, 2026
PLSS Review Dev login is working for me as well. I tested it in Chrome, Chrome Incognito, and Firefox. It's also integrating well with WHfB. Fancy.
stdavis commentedon Sep 4, 2026
Hit up Dave and Brandon on the IAM team about my ticket today. It looks like it's assigned to Dave and he didn't respond. I wonder if he is off on Fridays.
stdavis commentedon Sep 4, 2026
@chriswnek I updated the progress list in this issue description to be more useful for tracking migrations for each project. Should I add a column for creating an archer package and/or requesting the ping client credentials from the IAM team?
chriswnek commentedon Sep 10, 2026
Adding a column for the Ping client credential requests will be helpful. We only have two apps with a missing Archer package, and I'm tracking that elsewhere. I think we can leave Archer out of this issue to keep the table cleaner.
stdavis commentedon Sep 10, 2026
@chriswnek I spoke with Sean and he confirmed that we only manage a single GPS billpay app. Our app links to GovPay for payments but we are not involved with that app. So I think that the two TURN billpay items in the table can be combined into one.
stdavis commentedon Sep 10, 2026
Prod plss and plss-review were migrated tonight. There were a few bumps in the road. Mostly mis-configurations on the ping side or incorrect secret values. Note to self, don't start a migration unless the IAM folks are online and ready to help.
chriswnek commentedon Sep 17, 2026
RITM0502231 created for Mapserv. Once approved, we should be hearing from the IAM team on Client IDs, Secrets, etc.
chriswnek commentedon Oct 5, 2026
Received dev & prod config details for mapserv
stdavis commentedon Oct 6, 2026
For this quarter my goal is to migrate these apps:
stdavis commentedon Oct 13, 2026
Casey says that Govpay (DTS-UGRC-TURN GPS Network - Payment Gateway) doesn't use UtahID.
stdavis commentedon Oct 15, 2026
mapserv was migrated tonight without any major issues
@chriswnek You can start the requests for moonwalk and turn gps bill pay at your leisure.