News - week commencing 12 April 2021

From Monday 1 March 2021 the Platforms Support Desk will change its name to the IT Operations Centre Support desk. This means our email address will change to [email protected]. 

Any e-mails be sent to the [email protected] mailbox will forwarded and dealt with as normal. 

Domain names on the NHS Identity Path To Live (PTL) environments will be changing. You should prepare for this change.

The Live URL will not be changing - this only affects PTL environments. Most clients only have a presence in our DEV or INT environments. 

How this will affect you

Your server configuration: 

If your application uses NHS Identity for authentication, then any of your environments where you use the PTL environments for authentication will require a change of domain name in the OpenID Connect (OIDC) configuration. 

Authenticators:

If you use Windows Hello for Business (WHfB) platform authenticators, or Cross Platform Security Keys, you will need to book a 'binding session' as the previous credentials will be bound to the old domain name. This will not affect most people as the majority of PTL users use smartcard authenticators or just the simple OIDC realm without an authenticator. 

Smartcard users will need to update their 'smartcard bridge method' if using anything other than the Java Applet - see Authentication methods in a PTL environment.

iPad users will need a new version of the iPad app - remember the iPad app on PTLs is specific to that PTL only. A new version of the iPad app will mean you need to arrange a binding session to get the iPad bound to your identity.

Change schedule

Required actions

1. Determine which of your dev/test environments connect to which NHS Identity environments.
2. Plan in a configuration change for on or after the domain name change for those environments (your authentication will not work on the old configurations after that date).
3. Request a new version of the Chrome plugin 'smartcard bridge method' if you use it for smartcard authentication.
4. Install the NHS Credential Management app if you previously used the NHS Identity Hub for smartcard authentication.
5. Book a re-binding session with NHS Identity if you use either Windows Hello for Business, Cross Platform Security Key or iPad app.

Please confirm receipt of this message to [email protected] and also ask any questions you may have about this change. 

To improve stability of the Care Identity Service (CIS) platform we are moving the live CIS service (comprising authentication and application services) to the Cloud. This removes the risk of ageing hardware. This updated communication provides details of the actual go-live date and details of the pre-go live connectivity check. It also includes the details previously published. 

The Path to Live Development (PTL-DEV) and Integration (PTL-INT) CIS services have already been successfully migrated to the cloud. We are relocating the service from physical hardware to the cloud. The existing data in the environment will be migrated.

Suppliers/partners/trusts will continue to access the CIS service over the Health and Social Care Network (HSCN) after the transition.

During this transition weekend, Authentication and the Directory Service will remain available. From the start of the transition weekend, the CIS application, including any CMS operations on smartcards, will be unavailable. The application will be unavailable until the cutover is completed and agreement to turn on it on is confirmed on Monday 10 May.  

What this will mean to you

This change will improve platform stability, and the overall user experience. Ahead of the transition, your IT function will need to:

• make a change to your firewall
• apply root certificates
• if applicable, remove hard coded IP addresses

Please share this information with your IT department so they can take appropriate action.

What your IT function needs to do

You will need to execute the following steps to ensure your continued access to the service - these changes can be done ahead of the cutover:

1. Firewall changes

You will need to allow the traffic out from your firewall to the following address range 155.231.9.0/24 to ports 443 and 636. You will also need to allow inbound connectivity from this range to receive logout notifications. Making these firewalls changes ahead of the cutover will allow you to participate in the connection check described below - see 'pre go-live connectivity check' section below.  

When making these firewall changes, you may need to update your routing/NAT configurations to accommodate the new IP range (subject to how your network connections are set-up).

If your firewalls are configured using DNS names, rather than IP addresses, there should be no updates to make. 

It should be sufficient to perform checks to ensure you permit traffic to and from:

• portal.national.ncrs.nhs.uk
• ldap.national.ncrs.nhs.uk
• gas.national.ncrs.nhs.uk
• sbapi.national.ncrs.nhs.uk
• esw.national.ncrs.nhs.uk
• ldappoll.national.ncrs.nhs.uk
• uim.national.ncrs.nhs.uk

2. Root certificates

If you have explicitly added any of our certificates to any of your trust stores you will also need to ensure you add the new AWS root certificates ahead of the migration.

AWS root certificates

It is recommended all the certificates listed in the Root CAs section are installed in your Live estate.

3. Hard-coded IP addresses 

If you have hard-coded live IP addresses currently in place of domain name system (DNS) entries then these will stop working after the cutover and you will need to change any hard-coded addresses in advance.

If you have hard-coded the IP address of the service in place of DNS entries, you will need to ensure you return to using the DNS entries. This will ensure you are automatically directed to the new service when the transition takes place. The DNS entries required are:

• Authentication
• Directory
• Security Broker

During the cutover weekend, we will be updating DNS to point at the new IP range. If the instructions above are followed, we do not anticipate any issues. If you do encounter any issues resolving the host names we do recommend you clear down your DNS cache.  

During the transition window we anticipate a very small number of users, who have active sessions, may find that they need to re-authenticate again using normal smartcard processes. We have taken steps to minimise the number of users who will be affected in this way by choosing the timing of the transition carefully and by transitioning session data from the old to the new service.

After the cutover those using the legacy BT Identity Agent (IA) will need to restart the identity agent to pick up the DNS changes. BT IA is no longer supported and we strongly recommended that you upgrade to the latest version.

Pre go-live connectivity check

A few weeks ahead of the actual cutover, we would like you to perform a check. This check will allow you to test your connection to the new Production environment and ensure your firewall changes have been applied. If you experience any issues or would like some advice/guidance please contact SPINECIS, Sm at [email protected].

This check will only be available for a limited period of time between Monday 19 April (BST) 09:00 to Monday 26 April (BST) 18:00:

You will be able to check the connectivity to the new AWS platform using the hostnames:

• https://gas.prod.cis.spine2.ncrs.nhs.uk/
• https://sbapi.prod.cis.spine2.ncrs.nhs.uk/
• https://ldap.prod.cis.spine2.ncrs.nhs.uk

Specific instructions are below.

Testing connectivity

You can test connectivity to the gas and sbapi services using either a web browser or a command line utility such as curl. A successful connection will return the static response 'Welcome to CIS'.

curl https://gas.prod.cis.spine2.ncrs.nhs.uk/

Welcome to CIS

You can test the connectivity to the ldap service by using the openssl command line utility and your existing ldap client certificates.

If you are able to connect successfully you should see a response similar to the following.

Other Information 

In line with general security recommendations, CIS will no longer support SSL - only TLSv1 (and above) will be supported. If you are using SSL v2 or SSL v3 then you will need to upgrade to later versions of TLS before the CIS Live transition date. If you are using SSL, please can you directly contact SPINECIS, Sm at [email protected] urgently. 

As a reminder, the new CIS Cloud Service already hosts both a PTL-Development and PTL-Integration environment.  

The development environment is used by suppliers who are implementing the design, development and system test phases within their own test environment(s). They are also used to perform early testing against the Spine Core, Spine Care Identity Service (CIS) and NHS e-Referral service (e-RS) national systems.

The integration environment is used for integration testing which proves the end to end capability of messaging between the supplier’s test environment and a Path to Live test environment. It is strongly recommended that you use these PTL environments to test both the essential changes and the processes required to implement them.

As previously communicated, to improve stability of the Care Identity Service (CIS) platform we are moving the Live CIS service (comprising authentication and application services) to the Cloud to remove the risk of ageing hardware. This updated communication provides details of the actual go-live date and details of the Pre-Go Live Connectivity check. It also includes the details previously published.

As a reminder, this transition weekend is scheduled to take place between Friday 7 May (BST) 18:30 and Monday 10 May (BST) 08:00. During this transition weekend, Authentication and the Directory Service will remain available. From the start of the transition weekend, the Care Identity Service application including any CMS operations on smartcards will be unavailable. The application will be unavailable until the cutover is completed and agreement to turn on it on is confirmed on Monday 10 May. Smartcard unlocking will not be available until the CIS application is turned on, so it is advisable to notify users in your area that this function will be unavailable. Please refer to the previous update for further details 

Care Identity Service future changes

To improve stability of the Care Identity Service (CIS) platform we are moving the Live CIS service (comprising authentication and application services) to the Cloud to remove the risk of ageing hardware. The Path to Live Development (PTL-DEV) and Integration (PTL-INT) CIS services have already been successfully migrated to the cloud. This Live CIS Service transition is scheduled to take place late April/mid May and we will keep you updated as plans finalise and we have a definite date in place.

After the Live CIS transition, we will be planning to make the following future changes. Details of both these changes will be communicated.

1. CIS PTL-DEP/PTL-TRAIN environment will be migrated to the Cloud.
2. For the PTL-DEV environment, already transitioned to the Cloud, we will be making a change to the existing IP Range. This change will increase the network capability.

The IP address range should be changed from 10.239.67.128/25 to 10.239.57.0/24. You will need to modify to allow the traffic out from your firewall to the following address range 10.239.57.0/24 to ports 443 and 636. You will also need to allow inbound connectivity from this range to receive logout notifications.  

Please do not make any changes until further details are provided in the newsletter.