Nexus Documentation
CURL vulnerability information (CVE-2023-38545) - Nexus awareness advisory on Microsoft's update KB5014754

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 9 Next »

This article describes how to install and configure the iSecure Service, to enable integration between Smart ID Identity Manager (PRIME) Physical Access and iSecure. 

iSecure is an Access Control System provided by Security Shells and managed by a GUI and the service interacts with iSecure through the web-based iSecure API. iSecure is used to integrate with all versions of the HID access controllers VertX and EDGE. After integration, all administration of Users, Access Token and Entitlements (besides defining them) should be done in Identity Manager, never in iSecure. 

Some sections below are only relevant for Windows installations. For Docker deployment, see Deploy Smart ID Workforce. The instructons on configuring data fields are common for Windows and Docker deployments. 

For details on which data can be imported and exported from iSecure, see About import and export to Physical Access.


Prerequisites

 Prerequisites

The following prerequisites apply:

Limitations & constraints

 Limitations & constraints

The following limitations apply: 

  • In iSecure, only one card can be assigned per employee. If the Physical Access service finds more than one card to one employee which matches the configuration, then the old assigned card will be replaced with the new. 
  • Before a card can be assigned to an employee, it must be available in the iSecure system and must match the card format.
    → See the section Create Card in iSecure below.
  • The following employee fields in iSecure are required: Emp Code, Company, Location and Department. Emp Code shall contain any unique data from user records, other fields can either be static in the configuration or mapped as user additional fields.

Configure iSecure Service on Windows

The service is configured in the configuration file. All configuration is cached when the service starts so any configuration changes will require the service to be restarted in order to take effect.

 Set parameters in the configuration file

The configuration file is named ISecureService.exe.config.

Error rendering macro 'excerpt-include' : No link could be created for 'Set parameters in PACS connector configuration file'.

 Apply configuration

Error rendering macro 'excerpt-include' : No link could be created for 'Apply configuration changes in PACS connector service'.

Configure iSecure Service data fields

The iSecure data is configured in the configuration table in the Physical Access database. All configuration is cached when the service starts so any configuration changes will require the service to be restarted in order to take effect.

 Configure database

Error rendering macro 'excerpt-include' : No link could be created for 'Configure database in PACS admin panel'.

group: messagingqueue

keyData typeRequired or OptionalDescription
serverstringRequired

IP Address of Message Queue Server. If it is installed on the local server then we can use localhost. If we are accessing this server remotely then need to mention IP address.

usernamestringRequired

Username of message queue server.

Default value: “guest”

passwordstringRequired

Password of message queue server.

Default value: “guest”

systemstringRequired

Defines which messaging queue to be used, either "rabbitmq" or "azureservicebus".

Default value: "rabbitmq"

group: general

keyData typeRequired or OptionalDescription
deleteUserOnNoEntitlementstringOptional

Defines if the user shall be deleted if no active entitlement assignment are present for that user.

Valid values: true or false.

Default: true

deleteUserOnNoAccessTokenstringOptional

Defines if the user shall be deleted if no active access tokens are present for that user.

Valid values: true or false.

Default: true 

heartbeatInterval

intOptional

Heartbeat interval is the time difference between two successive heartbeats, and it is used to know if the system is in active (running) or in inactive (stopped) state.

Default value and minimum value: 60 seconds. If it is set less than 60 seconds, it will be considered as 60 seconds to update the status.

group: general

keyData typeRequired or OptionalDescription
updatesPerPollintOptional

The maximum number of messages read from the message queue.

Default: 100

iSecureApistringRequiredURL of the iSecure API for import and export details.

group: export

keyData typeRequired or OptionalDescription
cardNumberIdentifierstringRequired

This setting defines which type of identifier to use for card number.

Default: “mifare”.

empCodeFieldstringRequired

This setting defines which field to use for unique identification of users. It can be configured as follows. 

Examples:

  • user.ssn
  • user.[column name of user table]
  • useradditionalfield.[Type of additional field]
companyNamestringRequired

This setting defines the name of the company, which is mapped to the iSecure field Company.

If a different value is to be used, then it can be configured as follows:

Example: useradditionalfield.company

locationNamestringRequired

This setting defines the name of the location, which is mapped to the iSecure field Location.

If a different value is to be used, then it can be configured as follows:

Example: useradditionalfield.location

departmentstringRequired

This setting defines the name of the department, which is mapped to the iSecure field Department.

If a different value is to be used, then it can be configured as follows:

Example: useradditionalfield.department

accessTypestringRequired

This setting defines the way of access using Card Readers.

The following values are available:

  • "CardOrCardAndPin" (Default)
  • "CardOrPin"
  • "PinOnly"
cardFormatstringRequired

This setting specifies the available card format in the iSecure application. To not use any formatting, select “NoFormat”.

Default: “NoFormat”.

subDeptstringOptional

This setting defines the name of the sub-department, which is mapped to the iSecure field Sub-Dept.

If a different value is to be used, then it can be configured as follows:

Example: useradditionalfield.subdepartment

Example 

Example with static settings for company, location and department: 

IdGroupIndexKeySystemValue
1general 0

iSecureApi

ISecure

http://localhost/isecureapi/

2export0

cardNumberIdentifier

ISecure

mifare

3export0

empCodeField

ISecure

user.ssn

4export0

companyName

ISecure

Nexus

5export0

locationName

ISecureStockholm
6export0

department

ISecure

IT

7export0

accessType

ISecureCardORCardAndPin
8export0

cardFormat

ISecure

NoFormat

Example with user additional fields for company, location and department: 

IdGroupIndexKeySystemValue
1general 0

iSecureApi

ISecure

http://localhost/isecureapi/

2export0

cardNumberIdentifier

ISecure

mifare

3export0

empCodeField

ISecure

user.ssn

4export0

companyName

ISecure

useradditionalfield.company

5export0

locationName

ISecureuseradditionalfield.location
6export0

department

ISecure

useradditionalfield.department

7export0

accessType

ISecureCardORCardAndPin
8export0

cardFormat

ISecure

NoFormat

 iSecure field mapping

The service mainly transfers user data including related access tokens and entitlement assignments. The tables below show the default field mapping.

If needed, additional fields can be configured, using the SCIM API and useradditionalfield in the database configuration. 

User field mapping

By default, the following data is mapped between the USER table in the Physical Access and the iSecure service: 

SR NoPhysical Access field (Web API)iSecure field (UI)
1

Value configured under setting empCodeField

Emp Code
2Combination of givenName and FamilyNameName
3Value configured under setting companyNameCompany
4Value configured under setting LocationLocation
5Value configured under setting DepartmentDepartment
6Value configured under setting subDeptSub-Dept
7Status column of user tableStatus
8Address of user from Address tableAddress

Access token field mapping

By default, the following data is mapped between the ACCESSTOKEN and ACCESSTOKENIDENTIFIER tables in the Physical Access and the iSecure service: 

SR NoPhysical Access field (Web API)iSecure field (UI)
1Value configured under setting cardNumberIdentifierCard Number
2

Default Configuration for cardFormat

CardFormat

3

USER-PIN (No Direct link)

Pin column of user table

4

Default Configuration for accessType

AccessType

Entitlement assignment field mapping

By default, the following data is mapped between the ENTITLEMENTASSIGNMENT table in the Physical Access and the iSecure service: 

SR NoPhysical Access field (Web API)iSecure field (UI)
1

assigneeid (assignee -value)

Emp Code
2

ExternalId (ExternalId)

Access Groups Id (Access Groups Id, not on UI)

3

DisplayName (entitlement-DisplayName)

Access Group (Namn)

Install iSecure service on Windows

 Install service

The installation file is named ISecureService.exe.

Error rendering macro 'excerpt-include' : No link could be created for 'Install PACS connector service'.

Restart iSecure service on Windows

 Restart service

The service SystemId is named ISecure. 

Error rendering macro 'excerpt-include' : No link could be created for 'Restart PACS connector service'.

Create card in iSecure

 Create card in iSecure

Before assigning a card to an employee in Physical Access, the card must be created in iSecure.

To create a card, follow these steps: 

  1. Log in to the iSecure system: 

    Example: iSecure URL
    http://localhost/isecure/Login.aspx
  2. Go to Controller Setup Data > Card Inventory. Click on the + (Plus) button.
  3. Add the card number and select a card format.
    If the desired card format not available, then create the card format or select No Format. To create a card format, follow these steps:  
    1. Go to Controller Setup Data > Card Formats. Click on the + (Plus) button.
    2. Add a name of the card format and save it.

Related information

  • No labels

Copyright 2024 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions