**This message contains important details about changes to the Exchange Network Authentication and Authorization Service (NAAS)** 

Thank you to all the teams that have worked patiently to help test and troubleshoot the updated NAAS TEST environment.

Based on the testing and resolution of almost all reported issues, the migration of the NAAS application is proceeding in PRODUCTION on Saturday, April 24th from 8am to 4pm.

After the migration, EPA and its contractors will be actively monitoring traffic, working with the Exchange Network Help Desk, and partnering with teams to address any reported issues as quickly as possible. Please continue to work with the Exchange Network Help Desk if you have any questions or concerns.

Reminders:

• The Exchange Network Help Desk can provide new Secure Authentication Keys if you need one for TEST or PRODUCTION.
   
• New TEST and PRODUCTION IP Addresses are listed below. If you have outbound firewall rules to the NAAS, please make sure you enable access to these IP Addresses:
  • TEST: 204.47.254.135
  • PRODUCTION: 204.47.254.197

EXCHANGE NETWORK HELP DESK

• Email: [email protected]
   
• Phone: 1-888-890-1995 (Select Option 1 and then Option 5 from the menu) 
  Available 8:00 AM – 6:00 PM Eastern

Beginning on April 23, U.S. EPA will be making updates to the Exchange Network Quality Assurance Server (QA Server). The QA Server currently provides a set of SOAP web services for synchronous and asynchronous XML schema validations, schematron validation, XML transformation via XSLT, and virus scanning.  

As part of this reengineering effort, the current QA Server will be updated and migrated to a new platform. Some older, unused functionality will be retired, but most of the current functionality will remain the same. Exchange Network partners typically interact indirectly with the QA Server when downloading schema validation reports for an Exchange Network data flow. Most partners should experience little to no impact from these changes. 

Here are some important highlights about the upcoming changes:

• The current endpoints for the QA Server will not change:
  • Test endpoint will remain https://tools.epacdxnode.net
  • Production endpoint will remain https://cdxtools.epa.gov
     
• Virus Scanning will no longer have its own Web Services Definition Language (WSDL). The method will be consolidated under the remaining WSDLs. Virus scanning can be performed synchronously with the Validator_v30.wsdl or asynchronously with the ValidatorEx_v30.wsdl.
   
• The Validator and ValidatorEx XSLT document transformation service and the Schematron validation service will be deprecated.
   
• 2 WSDLs will remain available for use:
  • Validator_v30.wsdl
  • ValidatorEx_v30.wsdl

Please see below for more information about the timeline and other considerations.
 
Timeline
The schedule for deploying the changes is as follows:

• Test Environment – April 23, 2021
• Production Environment – April 30, 2021

After changes deploy to the Test environment, you may test services using the new QA server. If you have any issues or questions, please contact the Exchange Network Node Help Desk (see contact information below).
 
Exchange Network Node Help Desk 
For any questions or comments, or to report testing issues, please contact the Exchange Network Node Help Desk via:

• Email: [email protected]

**This message contains important new details about previously reported changes to the Exchange Network Authentication and Authorization Service (NAAS)** 
 
Thank you to all the teams that have helped test and provide feedback on the new TEST environment of the NAAS. Your responsiveness helps make the application better and helps EPA prepare for the forthcoming migration of the Production NAAS. At this time, EPA and its contractor team are still working with some organizations to help them diagnose and resolve issues with their applications, but the majority of teams’ issues have been resolved.
 
Here are some important updates on the ongoing migration process:

• NAAS Production Environment Cutover Pushed Back One Week
  In the interest of letting partners test more thoroughly and resolve as many issues as possible, EPA is delaying the Production NAAS cutover until the weekend of April 24^th. Once plans are finalized, we will send another EN Alert with a specific outage window.
   
• Policy and Access Denied Issues 
  This has been the most widespread issue reported to the EN Help Desk. The previous TEST NAAS implementation contained some blanket policies that allowed some TEST users to perform their work without having the correct policy credentials in place for their accounts. The new NAAS is enforcing policies correctly. Consequently, in the TEST environment, some users may need to request policies for the USER ACCOUNT and DATAFLOW that they are working in. Please continue to contact the EN Help Desk to have these policies put in place. So far, missing policies do not appear to be similarly widespread in Production. Further research is ongoing to prepare for the production cutover and ease agencies’ transitions.

Please continue to work with the EN Help Desk if you have any questions or concerns.
 
Reminders:

• The node help desk can provide new Secure Authentication Keys if you need one for TEST or PRODUCTION.
   
• New TEST and PRODUCTION IP Addresses are listed below. If you have outbound firewall rules to the NAAS, please make sure you enable access to these IP Addresses:
  • TEST: 204.47.254.135
  • PRODUCTION: 204.47.254.197

Exchange Network Help Desk

• Email: [email protected]
   
• Phone: 1-888-890-1995 (Select Option 1 and then Option 5 from the menu) 
  Available 8:00 AM – 6:00 PM Eastern

**This message contains important details about changes to the Exchange Network Authentication and Authorization Service (NAAS)** 
 
On Monday, April 5^th at 6:00 PM EDT, U.S. EPA deployed changes to the TEST environment of the Exchange Network Authentication and Authorization Service (NAAS). These changes are part of the previously reported migration to a new NAAS platform.
 
EPA is asking partner agencies to test their Exchange Network applications and data flows and report any issues to the Exchange Network Help Desk (see contact info below). Partners should test their ability to authenticate, submit, and solicit data with EPA’s Central Data Exchange (CDX) in the TEST environment.
 
EPA is currently tracking a handful of issues that they hope to have resolved within the next 1-2 days. These include:

• Policy and Access Denied Issues – The previous NAAS implemented policy conditions inconsistently and some users were able to perform their work without being granted the necessary NAAS policies. The updated NAAS is enforcing policies correctly. If you are receiving an error that states “Access Denied” or “Access to the requested resource… is not permitted based on policy”, please reach out to the Exchange Network Help Desk and share the USER ACCOUNT that you are using and the DATA FLOW you need to access. The Help Desk will apply the correct policy for you.

• “Multiref” Error – Users may see an error message that states: “Message part multiRef was not recognized. (Does it exist in service WSDL?)”. This issue occurs when some NAAS v2 method parameters are transferred as multiRef elements rather than simple XML elements. This is a known issue for partners that are using v1 of the NGN Node. This issue affects NAAS v2 methods in: auth.wsdl, policy.wsdl, securitytoken.wsdl, usermgr.wsdl. NAAS v3 methods are unaffected.

• Validation report errors – The QA Server is having issues responding with validation reports. This is being rectified.

If you are experiencing these or any other connectivity issues with the NAAS TEST environment, please contact the Exchange Network Help Desk as soon as possible. This will allow support staff ample time to resolve issues before the planned migration of the NAAS Production environment on April 18^th.

The NAAS Production environment cutover is still planned to occur on the weekend of April 18^th, assuming successful testing by EN partner agencies. If partners are having trouble pinpointing or resolving issues in the TEST environment, EPA may delay the changes to PRODUCTION until the weekend of April 25th.
 
Please work with the Exchange Network Help Desk if you have any questions or concerns.

• The Help Desk can provide new Secure Authentication Keys if you need one for TEST or PRODUCTION.

• The new NAAS TEST and PRODUCTION IP addresses are listed below. If you have outbound firewall rules to the NAAS, please make sure you enable access to these IP addresses:
  • TEST: 204.47.254.135
  • PRODUCTION: 204.47.254.197

 Exchange Network Help Desk

• Email: [email protected]

• Phone: 1-888-890-1995 (Select Option 1 and then Option 5 from the menu) 
  Available 8:00 AM – 6:00 PM Eastern