USDA Account Registration Document

Various types of accounts are available for customers and for Federal employees and contractors, both inside USDA and in other agencies. eAuthentication accounts are available to USDA customers at two levels, 1 and 2.

Level 1 access, for tasks such as visiting a USDA web page, obtaining general information about the USDA or its agencies or participating in public surveys for a USDA agency
Level 2 access includes all of the capabilities of level 1 with additional access. Because additional access is provided for level 2 customers, additional authentication is required:
- Local Registration Authority (LRA) for Identity Proofing
- Online Identity Proofing (OIDP)
USDA employees and contractors can also register for accounts.
Federal employees and contractors who are affiliated with organizations other than USDA can also obtain accounts. The types of accounts available to non-USDA Federal employees and contractors depend upon federation or non-federation with USDA
- For agencies that have established a Federation partnership
- For agencies that have NOT established a Federation partnership (ICAMaaS PIV/CAC Account)

Purpose

This document details how USDA customers can obtain a USDA eAuthentication account that allows access to USDA web applications and services protected by eAuthentication.

Customers may obtain an account with Level 1 or Level 2 access. These accounts are obtained through an electronic self-registration process, Local Registrant Authority or through Online Identity Proofing (OIDP).

Audience

This is an informational document addressed to all internal audiences.

Scope

This document outlines the process for registering for eAuthentication accounts. Details on specific steps are documented elsewhere.

Terms and Definitions

Activation	Registration process result; a valid account.
Assurance Level	One of four levels describing the degree of certainty that a user has in credentials: Level 1 assurance – Little or no confidence in the asserted identity’s validity. Requires a username and password. Level 2 assurance – Some confidence in the asserted identity validity. Requires a username and password. The user must be identity proofed by a designated Local Registration Authority (LRA). Level 3 assurance – High confidence in the asserted identity’s validity. eAuthentication does not currently support level 3. Level 4 – Very high confidence in the asserted identity’s validity. eAuthentication does not currently support level 4.
Government-issued Photo ID	State Driver’s License, State Identification Card or Passport
Registration	Entering a name and other identifying information along with a selected ID and password to initiate an account.
Social engineering	A method used by hackers to obtain passwords for unauthorized access. Typically, this involves calling an authorized user of a computer system and posing as a network administrator.
Verification	Ensuring that your information is accurate before creating your account.

Determining Type of Access

Customers may obtain an account with Level 1 or Level 2 access. These accounts are obtained through an electronic self-registration process. Internal users may obtain an account which is initiated at employment by HR. Each of these types of access is covered in subsequent sections:

Customer Access Level 1 Section 3
Customer Access Level 2 Section 4
Identity Proofing Through a Local Registration Authority (LRA) Section 5
Online Identity Proofing Section (OIDP) 6
ICAMaaS PIV/CAC Account 7
Federation Account 8
Internal Access Section 9

Use the table below to determine applicable sections. Read from left to right using the headers to guide you through the three levels of questions.

First Question	Select	Second Question	Select	Third Question	Select	See Section(s)
Are you a Federal employee or contractor?	No	What level of access do you require?	Level 1			See Section 3, Obtaining Level 1 Access
			Level 2	Will you use LRA?	Yes	See Section 4, Obtaining Level 2 Access and Section 5, Visiting a Local Registration Authority (LRA) for Identity Proofing
			Level 2	Will you use OIDP?	Yes	See Section 4, Obtaining Level 2 Access and Section 6, Using Online Identity Proofing (OIDP)
	Yes	Are you a Federal employee or contractor at USDA?	No	Is your agency Federated?	No	See Section 7, Registering for an ICAMaas PIV/CAC Account
			No	Is your agency Federated?	Yes	See Section 8, Registering for a Federation Account
			Yes			See Section 9, Registering for an Internal Account

If you are a customer, consider these aspects when selecting level of access:

Typical usage requiring Level 1

Visit a USDA web page that indicates a Level 1 account is necessary
Obtain general information about the USDA or its agencies
Participate in public surveys for a USDA agency

Typical usage requiring Level 2

Submit official business transactions via the Internet
Enter into a contract with the USDA
Submit forms or applications for the USDA via the Internet

Note: If you have a level 1 account, you can apply for level 2 access by logging in and completing all required information. Identity proofing by a Local Registration Authority (LRA) or Online Identity Proofing (OIDP) is required.

Getting Started for Customer Access

Go to the self-registration page https://identitymanager.eems.usda .gov/registration/index.aspx OR https://www.eauth.usda.gov (and select "Create an account" on the left side.)
Choose the level of access you need.

Figure 1 Account registration page

Obtaining Level 1 Access

To obtain a Level 1 USDA eAuthentication account, go to: https://identitymanager.eems.usda.gov/registration/selfRegistratio nForm.aspx?level=1

The three steps to self-register are:

Account Registration
Account Verification
Account Activation

Registering a Level 1 Account

Complete all fields on the screen that are marked with a red asterisk *.

Figure 2 Level 1 account registration fields

The first set of fields require your name, valid email address, User ID, and password.

Match your name with your valid government-issued photo ID. The User ID will populate with a suggestion based on your email address. You can change it if you have a different preference.

You can click on the ? Box to the right of the fields for questions.

	DATA POINT	CRITERIA
	User ID	User ID must be 6-20 characters in length. Note: Select your User ID carefully - do NOT include your SSN for example - once your User ID is created you will be unable to modify it.
	Password	• 9 to 12 characters long • Contains at least one uppercase letter • Contains at least one lowercase letter • Contains at least one number or a special character: ! # - $ % * = + : ; , ? ~ In addition: • Your password may not contain your first name, last name, User ID, Mother’s Maiden Name, Date of Birth, 4-digit PIN, or security questions or answers. • Your password may not contain words that can be found in a dictionary, spaces, tabs, or any other special characters not listed above. Note: Your password will expire after 60 days.
	First Name, Last Name	Enter exactly as on your State Driver’s License, State Identification Card, or Passport.
	Email	Enter a valid working email address.
You can optionally fill out the following fields:
DATA POINT			CRITERIA
Middle Initial			Enter exactly as on your State Driver’s License, State Identification Card, or Passport.
After entering the information on the initial screen, click Continue. For questions about each set of fields, you can click on the ? box to the right of the fields. The next set of fields are for your security questions. Security questions are questions that only you know the answers to: This feature assists you during self-service for a forgotten User ID or password. It also ensures that your account is more secure from social engineering. You can review and change your questions once you are logged into your eAuth account.

Figure 3 Security questions

Verifying Level 1 User Information

This screen allows you to verify that your information is accurate before creating your account.

If there is any field that requires correction, press the Edit button to return to the previous screen and make the correction.

If everything is correct, press the Submit button.

Caution: Once you have confirmed your eAuthentication credential, it will become your official electronic identity online throughout USDA. Take great care in protecting your password - it is your responsibility to keep this electronic identity private to prevent identity theft. Do NOT share your password or write it down in an insecure location.

Receiving Activation Email

If you have registered with a valid email address, you should receive a confirmation email within a few minutes. The email contains a link to activate your new eAuthentication account.

Figure 4 Level 1 account verification

Important: Click on the link to activate your account. If you have not received the confirmation email within 24 hours, check your spam or junk folder.

For additional assistance contact the eAuthentication Help Desk at 800-457-3642 (Option 1) or [email protected].

Obtaining Level 2 Access

The Level 2 self-registration process is very similar to the Level 1 process, except that you will need to be identity-proofed by a Local Registration Authority (LRA) or to have Online Identity Proofing (OIDP) for the account to become Level 2.

To obtain a Level 2 USDA eAuthentication account, go to https://identitymanager.eems.usda.gov/registration/selfRegistrationForm.aspx?level=2.

Figure 5 Level 2 Account Registration

The four steps to self-register are:

Account Registration
Account Verification
Confirmation Email with LRA Instructions
Identity Proofing

Registering a Level 2 Account

Complete all fields on the screen that are marked with a red asterisk *.

Figure 6 Level 2 account registration

The first set of fields require your name, physical address, valid email address, User ID, and password.

Match your name with your valid government-issued photo ID. The User ID will populate with a suggestion based on your email address. You can change it if you have a different preference.

You can click on the ? Box to the right of the fields for questions.

DATA POINT	CRITERIA
User ID	User ID must be 6-20 characters in length. Note: Select your User ID carefully - do NOT include your SSN for example - once your User ID is created you will be unable to modify it.
Password	• 9 to 12 characters long • Contains at least one uppercase letter • Contains at least one lowercase letter • Contains at least one number or a special character: ! # - $ % * = + : ; , ? ~ In addition: • Your password may not contain your first name, last name, User ID, Mother’s Maiden Name, Date of Birth, 4-digit PIN, security questions or answers. • Your password may not contain words that can be found in a dictionary, spaces, tabs, or any other special characters not listed above. Note: Your password will expire after 60 days.
First Name, Last Name	Enter exactly as on your government-issued photo ID.
Email	Enter a valid working email address.
Home Address, Home City, and Home State	Enter your current home address, city, and state.
Home Postal /ZIP Code	Enter your current home postal/ZIP code.
Country	Select the country you currently reside in.

You can optionally fill out the following fields:

DATA POINT	CRITERIA
Middle Initial	Enter exactly as on your government-issued photo ID.
Home Phone	Enter your current home phone.
Alternate Phone	Enter an alternate phone.

After entering the information on the initial screen, click Continue. For questions about each set of fields, you can click on the ? box to the right of the fields.

The next set of fields are for your security questions. Security questions are questions that only you know the answers to:

This feature assists you during self-service for a forgotten User ID or password.
It also ensures that your account is more secure from social engineering.
You can review and change your questions once you are logged into your eAuth account.

Figure 7 Security questions

Verifying Level 2 User Information

This screen allows you to verify that your information is accurate before creating your account.

If there is any field that requires correction, press the Edit button to return to the previous screen and make the correction.

If everything is correct, press the Submit button.

Caution: Once you have confirmed your eAuthentication credential, it will become your official electronic identity online throughout USDA. Take great care in protecting your password and the security questions that you stored - it is your responsibility to keep this electronic identity private to prevent identity theft. Do NOT share this password or write it down in an insecure location.

Receiving Activation Email

If you have registered with a valid email address, you should receive a confirmation email within a few minutes. The email contains a link to activate your new eAuthentication account.

Important: Click on the link ‘Activate My Account’ to activate your account.

If you have not received the email within 24 hours, check your spam or junk folder.

Also log into your profile and re-confirm your name and date of birth matches your government-issued photo ID.

Figure 8 Level 2 account verification

Note: Once you have completed this step, you have a valid Level 1 account and will see the following screen. In order to obtain an activated Level 2 account you will need to complete identity proofing.

Figure 9 Activation Email instructions

Identity Proofing

Customers requiring level 2 accounts have two options:

Visiting a Local Registration Authority (LRA) for Identity Proofing, See Section 5
Using Online Identity Proofing (OIDP), See Section 6

Visiting a Local Registration Authority (LRA) for Identity Proofing

Bring a valid government-issued photo ID. Valid IDs are:

Driver's License issued by a USA state or Canadian province.
Photo ID card issued by a USA state or Canadian province.
US Military or US Federal Government PIV/CAC (Smart) identification card (DoD, DoS, DHS, NDU, etc.)
Valid passport issued by any country listed on the U.S. Department of State website.

To find the nearest USDA Service Center with a Local Registration Authority (LRA), go to http://offices.sc.egov.usda.gov/locator/app?type=. We recommend calling ahead to schedule an appointment.

Figure 10 LRA authority locations

Important: Before you visit a USDA Service Center, Verify that all of your information on file with USDA is correct. Incorrect data will result in failure of the in-person Identity Proofing Process. To verify or update your information, go to the eAuthentication web site at www.eauth.egov.usda.gov and click on Update your account, then log in with your User ID and password. Select Modify my profile and make any needed changes.

If you experience any issues with self-registration or have eAuthentication related questions, contact the eAuthentication Help Desk for assistance: 1-800-457-3642 (Option 1) [email protected]

Using Online Identity Proofing (OIDP)

Consent statement

By clicking the “I AGREE” button, you are providing written consent to the United States Department of Agriculture (USDA) under the Fair Credit Reporting Act authorizing the USDA to obtain information from your personal credit profile or other information from Experian. By clicking “I AGREE”, you agree to the Terms of Service, and you authorize the USDA to obtain such information solely to verify your identity for the purpose of avoiding fraudulent transactions in your name.

Terms of Service

You must be able to verify some information about yourself and:

Have a Social Security Number
Have a U.S. mailing address

You can only verify your own identity. You cannot attempt identity verification on behalf of another person or using another person’s information or identity, even if you have written permission. Only you can use the eAuthentication account that you created. You can never share the use of your account with anyone else under any circumstances. You can never use another person’s account.

What will we do with your information?

We use the information you give to us to verify your identity using Experian Credit Services. We do not store your Social Security Number. It is used only for identity verification purposes. When we make a verification request with Experian, they may use information from your credit report to help verify your identity. As a result, you may see an entry called a “soft inquiry” on your Experian credit report. This will show an inquiry by the United States Department of Agriculture with our address and the date of the request. Soft inquiries do not affect your credit score, and you do not incur any charges related to them. Soft inquiries are displayed in the version of the credit profile viewable only to consumers and are not reported to lenders. The soft inquiry will generally be removed from your credit report after 25 months. Once your identity has been verified, you will not generate additional soft inquiries when logging in with your eAuthentication account.

What happens if you provide false information or misuse this service?

You may be subject to criminal or civil penalties, or both, if you provide false or misleading statements in order to obtain an eAuthentication Level 2 credential, or engage in unauthorized use of this service.

What are you responsible for?

You accept that the responsibility to properly protect any information provided to you by the United States Department of Agriculture is yours, and that you are the responsible party should any information on or from your computer or other device be improperly disclosed. You agree the USDA is not responsible for the improper disclosure of any information that USDA has provided to you, whether due to your own negligence or the wrongful acts of others.

Perform the following steps to validate your Level 2 account. Go to USDA eAuthentication website https://www.eauth.usda.gov.

Figure 11 eAuthentication Home

Click on Update your account on the left side and log into your eAuth profile.
Click on the Users tab.
Click on the Manage Users link to expand the list of options.
Click on the Validate Level 2 Customer – OIDP. The Validate Level 2 Customer – <Agency> OIDP-LRA: Select User page is displayed.

Figure 12 User's tab

Select Last Name from the Search Option drop down menu. Leave the “=” in the next box to specify exact match (Equals “=“ is the default).

The drop down menus allow the LRA to manipulate the search criteria

Figure 13 Drop down menu

Enter your last name as entered when registering for an account and as printed on your valid form of identification. (Not case sensitive).

Figure 14 Entering user names

Click the “+” button to display additional search criteria (such as First Name, User ID, State).
Select First Name from the second Search Option drop down menu. Leave the “=” again to specific an exact match.
Enter your first name as entered when registering for an account and as printed on your valid form of identification. (Not case sensitive).
Click Search. Search results are displayed on the Validate Level 2 Customer – <Agency> OIDP LRA: Select User screen.
If your name appears in the search results, click on the circle to the far left, next to your Login ID. The circle will fill when selected.
Click Select in the bottom right corner to retrieve your profile for validation.

The Assurance Level will indicate Level 1 until the LRA validates the customer’s identity submits the Validate Level 2 Customer – <Agency> OIDP LRA task

Figure 15 Assurance level

Figure 16 Level 2 customer validation

Using the Validate Level 2 Customer – <Agency> OIPD LRA Profile task, review the information listed in the your User Profile.

Note: If the information in the profile does not exactly match the first name, last name and date of birth on the Government Issued ID, you will need to correct your User Profile using the Apply for Level 2 Account task. You should then contact Call Center Pilot LRA to complete the eAuthentication Identity Proofing process.

Once your eAuthentication Profile matches your Government Issued ID, access the national credit bureau portal and input the required information from your profile.
When the national credit bureau portal returns a series of Quiz Questions, read them and submit the answers.

National credit bureau

Transaction #

Figure 17 Level 2 customer validation pilot

The portal will return a Pass or Fail response, or a secondary Quiz Question.
If the response is Pass copy the national credit bureau Transaction # from the national credit bureau portal, and paste it into the IDP Transaction ID in the Identity Manager task.

Note: If the national credit bureau portal returns a Fail response, locate your nearest Local Registration Authority to conduct an in-person Identity Proofing. Do not submit the Identity Manager task.

Click the Submit button to activate to Level 2 access

Note: A Confirmation message will display once the LRA activates a customer.

Figure 18 Confirmation message

Once the task is processed you will receive an email notifying you of the account upgrade.

Figure 19 Email

Registering for an ICAMaaS PIV/CAC Account

ICAMaaS PIV/CAC accounts are for non-USDA federal employees and contractors, who work for agencies that are not Federation Partners with USDA. This type of account enables you to access applications that are integrated with eAuthentication by using their PIV or CAC agency-issued card. To initiate account registration, browse to the eAuth protected application. You will be redirected to the eAuth Federation login page.

Figure 20 Agency Partner Login

Select your agency from the drop down menu and click on Submit.

Figure 21 Agency drop down list

Select a PIV authentication certificate.

Figure 22 Selecting a PIV authentication certificate

Enter your PIN and click OK.

Figure 23 Enter PIN

Enter your work email address twice for confirmation and click Continue.

Figure 24 Entering email address

Verify that you receive the PIV/CAC Account registration Request Successful page.

Figure 25 Request Successful page

Retrieve the email from your work email address. Follow the instructions in the email to complete the process.

Figure 26 Confirmation email

Click on the ‘Create My Account’ link in the email.
Select a PIV authentication certificate and click OK.

Figure 27 Selecting a PIV authentication certificate

Your eAuthentication account will be created using the data from your PIV/CAC Authentication Certificate. Verify that you receive a PIV/CAC Account Creation Successful page.

Figure 28 PIV/CAC Account Creation Successful page

Registering for a Federation Account

ICAMaaS Federation accounts are for non-USDA federal employees and contractors, who work for agencies with whom the USDA has established a Federation partnership. This type of account enables you to access applications that are integrated with eAuthentication by using a credential issued to you by your agency. To initiate account registration, browse to the eAuth protected application. You will be redirected to the eAuth Federation login page.

Figure 29 Agency Partner Login

Select your agency from the drop down menu and click on Submit.

Figure 30 Agency drop down list

Authenticate to your agency’s login page using any supported method (PIV, User ID and password).

Figure 31 Sample login page

Important: A SAML assertion is sent from the agency identity provider to the USDA eAuthentication asserting that the user has been eAuthentication will attempt to find the user based on the unique identifier included in the SAML assertion. If the unique identifier cannot be found, an account is created using information contained in the SAML assertion.

Verify that you receive the Account Linking Successful page.

Figure 32 Account Linking Successful page

Registering for an Internal Account

Most positions in the USDA require internal eAuthentication accounts. These include employees, contractors, volunteers and affiliates.

The six steps to register are:

Verifying Identity

Confirming Identity Verification
Submitting an Account Request Form
Receive Request Form Confirmation
Create User ID and Password
Registration Completion
Email Confirmation

The eAuthentication system uses data from your Human Resources record to create an account for you. The registration process allows you to activate your account and set your security questions and attributes.

You will receive an automated email from the USDA EEMS system for account registration once your HR record has been submitted. Click on the link provided in your email to begin the registration process. If you do not receive an email, you will need to contact the Agency Registration Lead (ARL) for your agency. To locate your ARL, go to: https://www.eauth.usda.gov/MainPages/AgencyRegistrationLeads.aspx

Shape11 Shape10

Figure 33 HR Email

Verifying Identity

Complete all fields on the Register Your User Account screen that are marked with a red asterisk *.

The first set of fields require the last 4 digits of your social security number and your birth date to confirm your identity.

Your entries should match the information provided in your HR record.

Figure 34 Register a user account

DATA POINT	CRITERIA
Last 4 digits of SSN	Enter the last 4 digits of your Social Security Number
Date of Birth	Enter your date of birth, using the pull down menu.

After entering the information on the initial screen, click Continue. For questions about each set of fields, you can click on the ? box to the right of the fields.

Note: If you receive an error stating that the information you provide does not match our records, contact your HR representative.

Confirming Identity Verification

On the following screen, verify the information that is displayed.

Figure 35 Verification confirmation

If your email address is not correct, close your browser window (click on the red “x”) and contact your Agency Registration Lead for assistance: http://www.eauth.egov.usda.gov/AgencyRegistrationLeads.html
If any of your HR information is not correct, note which information is not correct and close your browser window (click on the red “x”). Contact your HR rep and ask them to review the items you’ve noted.
If all of the displayed information is correct, click Yes.

Submitting Account Request Form

There are three main sections that need to be filled out on this screen:

Security Questions
- Select 4 different security questions using the pull-down menus.
- Type an answer that only you would know (information that is non-researchable.) Answers are not case sensitive, however spaces and spelling do matter, so enter something that is easy to remember.
Email Address Information (either your USDA email or a different email address)
Security Information
- Enter your mother’s maiden name for security verification purposes.
- Create and enter a 4 digit PIN number. Note: You cannot use a zero "0" as the first digit.

Ensure that all information is filled out accurately. The information provided will assist you if you need to use our Self Service functions or for contacting the help desk.

Security Questions

Security questions are questions that only you know the answers to. This feature assists you during self-service for a forgotten User ID or password. It also ensures that your account is more secure from social engineering. You can review and change your questions once you are logged into your eAuth account.

Figure 36 User account security questions

Figure 37 Selecting security questions

After entering the information, click Continue.

Email Address Information

If you already have a valid USDA email address that has been added to your HR record, you will see it listed in the email field. If not, enter in a valid email address or change your existing USDA email address by editing the field. Next, re-enter the email address for confirmation.

Note: the email address entered must be valid and cannot be a duplicate of an existing email address in our system.

If you receive a duplication error, try a different email address. You can create a temporary email address at Gmail, Yahoo, Hotmail, or other email providers.

Figure 38 Email address information

Security Information

Security Information is used to verify your identity over the phone should you need to contact the help desk for assistance. Create a 4 digit PIN number that you can remember. The PIN may not start with a 0. Once you have completed the form in Step 3 in its entirety, press the Continue button at the bottom right.

Figure 39 Security information

Request Form Confirmation

This screen allows you to verify that your information is accurate before creating your account. If there is any field that requires correction, press the Edit button to return to the previous screen and make the correction. If everything is correct, press the Continue button.

Figure 40 Security question and answer confirmation

Registering Your User ID and Password

Our system automatically generates your User ID based on the name in your HR record. You will need to create a password for your eAuthentication account that meets the NIST guidelines for secure passwords. For more information about creating a secure password, review our other guides:

Tips on Creating a Strong Password for your eAuthentication Account, www.nrcs.usda.gov/wps/PA_NRCSConsumption/download?cid=stelprdb...
eAuthentication Security Responsibilities for End Users, https://www.eauth.usda.gov/_GlobalAssets/Documents/USDA_eAuth_SecurityResponsibilitiesForEndUsers

Figure 41 User ID and password

Registration Completion

The final step of your registration will provide you with your User ID and the email address you have used to register your eAuthentication account. You will also receive a confirmation email providing you with the same information. If you do not see it in your email inbox, check the Spam or Junk folder.

Note: We recommend waiting 10 minutes before you attempt to log in to other websites, to allow for system propagation.

Figure 42 Registration completion

For More Information

For additional registration assistance, contact your Agency Registration Lead. Contact information can be found at: https://www.eauth.usda.gov/MainPages/AgencyRegistrationLeads.aspx

Figure 43 Finding an agency registration lead

If there are any discrepancies in the information provided from your HR record during registration, contact your HR representative.

If you have any other technical issues or have any questions regarding your eAuthentication account, contact the eAuthentication Helpdesk:

1-800-457-3642 (Option 1)

[email protected]

Provide this information: Description of the issue, Type of account you are trying to create (Level 1 Customer, Level 2 Customer, or Employee account). If you have received an error message, also include the exact text of the error message.

If you have received an error message, also include the exact text of the error message.

For internal use only

File Type	application/vnd.openxmlformats-officedocument.wordprocessingml.document
Author	Esther.Walden
File Modified	0000-00-00
File Created	2021-01-22