Nexus Documentation
CURL vulnerability information (CVE-2023-38545) - Nexus awareness advisory on Microsoft's update KB5014754

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

This article describes how to install and configure the Bravida Integra Service, to enable integration between Nexus PRIME PACS Backend and Bravida Integra. 

Integra is an Access Control System provided by Bravida and managed by a GUI and API to interact with Integra through the EasyConnect V2.

After integration, all administration of Users, Access Token and Entitlements (besides defining them) should be done in Nexus PRIME, never in Integra.

For details on which data can be imported and exported from Integra, see About import and export to PRIME PACS Backend.


Prerequisites

 Prerequisites

The following prerequisites apply:

  • PRIME PACS Backend is installed. See here.
  • Bravida Integra must be installed, version 7.20 or later. The system Integra EasyConnect v 2 is required to interact with Integra. 
  • The message queue server must be running.

Configure Integra Service

The service is configured in the configuration table in the PACS Backend database and in the configuration file. All configuration is cached when the service starts so any configuration changes will require the service to be restarted in order to take effect.

 Set parameters in the configuration file

The configuration file is named IntegraService.exe.config.

Error rendering macro 'excerpt-include' : No link could be created for 'Set parameters in PACS connector configuration file'.

 Configure database

Error rendering macro 'excerpt-include' : No link could be created for 'PACS Backend database - messagingqueue parameters'.

group: general

keyData typeRequired or OptionalDescription
updatesPerPollintOptional

The maximum number of messages read from the message queue.

Default: 100

group: integra

keyData typeRequired or OptionalDescription
sessiontokenstringRequired

To communicate with the Integra client through the easy connect service we need session token. The Session token is unique GUID assigned to the user of the Integra client. We can find this session token inside IDA server setting configuration. Open IDA application located at {installation_path}\Bravida Integra\IDA\Ida.Server.Config.exe. Open the application and go to tab IEC2. Use the session token of valid Integra user.

parentFolderPathstringRequiredTo export all user details to the specific folder of Integra we can use configuration. Default parent folder path is Administration\Kortinnehavare. If the path is incorrect, the service will not start and will throw an exception as Folder path not found. All folder path list is available in the table folder of the Integra database.
emailTypestringRequired

This indicates which type of email to export to Integra. If email type is not found then the first email of emails list will be sent.

Default email type: work

group: export

keyData typeRequired or OptionalDescription
maxValidYearsintRequired

Max valid years for a card.

idcSystemNumbersintOptional

List of system numbers. 

userfieldmappingsstringOptional

userfieldmappings is the combination of all additional fields which can be sent to Integra.

Currently, the following fields can be configured:

  • EmailAddress
  • Department
  • Description
  • FreeInfo1
  • FreeInfo2
  • FreeInfo3
  • UserInfo

To export these fields to Integra, do the following configuration:

IdGroupIndexKeySystemValue
17export0userfieldmappingsIntegrauseradditionalfield.Department,Department
18export0userfieldmappingsIntegraemail.Work,EmailAddress
19export0userfieldmappingsIntegrauseradditionalfield.FreeInfo1,FreeInfo1
20export0userfieldmappingsIntegrauseradditionalfield.UserInfo,UserInfo
21export0userfieldmappingsIntegrauseradditionalfield.Description,Description
22export0userfieldmappingsIntegrauseradditionalfield.FreeInfo2,FreeInfo2
23export0userfieldmappingsIntegrauseradditionalfield.FreeInfo3,FreeInfo3

The value in the configuration table_name.value_of_type_column,property_name_of_cardholder. This configuration setting is the mapping between the PACS Backend table field and Integra cardholder model properties. User column fields can be sent by adding the configuration user.column_name_of_user_table,property_name_of_cardholder.

group: export.idcSystemNumber-{index}

The {index} is an PACS Backend system number that shall map to a specific system number in Integra. This index must also exist in the idcSystemNumbers configuration. For example, if idcSystemNumbers-1 exists, then the configuration group export.idcSystemNumber-1 must be configured in the database. Each group holds settings for a specific Integra system number.

If this configuration setting is not added into the database then the default configuration, export.idcSystemNumber-default is used.

For each configuration group we have the following settings:

keyData typeRequired or OptionalDescription
cardNumberIdentifierTypesstringRequired

This comma-separated list indicates which access token identifier is stored for this specific Integra system.

If this list contains two columns separated by comma, then the system will check if the field exist on the card identifier. if they exist, then two card objects will be exported to Integra for that system. If any specified column does not contain a valid Integra card number for this system, then the export will fail for this card.

MaxCardNumberLengthintRequired

This parameter decides how long the card numbers can be when sending them to Integra. If they are longer, they will be trimmed down. Note that since card numbers are not sent “as-is” to Integra, there may be times where card numbers are not unique. If this occurs, the card will not be exported and an error will be logged.

Integra requires card numbers of at least 6 digits. If MaxCardNumberLength is specified to less than 6 digits, the export will pad the card number with leading zeros and send a card number of 6 digits.

IntegraSystemNumberintRequiredThis is the system number in Integra.
exportPinboolRequiredThe value indicates if the pin code should be exported to Integra or not.
maxPinLengthintRequiredThe value indicates the maximum length of the pin we can send to Integra. Minimum length of the pin is 4 by default. In Integra maximum length can be 6 and it depends on system number.
ExportableboolRequiredThe value indicates if cards shall be exported to this system in Integra. If this is false, none of the above configurations will be used.
CardNumberRangestringOptional

The value indicates a number range for the card.

If this configuration exists, then each card number exported to this system will be validated according to this range. If the card number is outside of the range, the card will not be exported to Integra. If this is not configured, all card numbers are deemed valid and will be exported to Integra.

Example

The following is an example of access token identifier mapping with Integra:

IdGroupIndexKeysystemvalue
6export0idcSystemNumbersIntegradefault
7export.idcSystemNumber-default0cardNumberIdentifierTypesIntegramifare
8export.idcSystemNumber-default0maxCardNumberLengthIntegra6
9export.idcSystemNumber-default0integraSystemNumberIntegra1
10export.idcSystemNumber-default0exportPinIntegraTRUE
11export.idcSystemNumber-default0maxPinLengthIntegra4
12export.idcSystemNumber-default0ExportableIntegraTRUE
13export.idcSystemNumber-default0cardNumberRangeIntegra1-999999

The system will export all matching access token identifiers to all Integra systems where it gets a matching on cardNumberIdentifierTypes. In the example, if the access token contains a mifare identifier, then the data will be exported to the above system.

 Configure Bravida Integra to allow deleting identities

When a cardholder is to be deleted in Integra, the service will attempt to just delete the cardholder immediately, without deleting the cards held by the cardholder first. By default, this is not allowed by Integra.

To allow this, configure Integra to either detach or delete cards automatically when the cardholder is deleted:

  1. Open the Integra GUI.
  2. Go to Alternativ > Inställningar and then to Objekt > Kortinnehavare > Radering.
  3. Do either of the following settings:
    1. To detach the cards, select “Frikoppla”.
    2. To delete the cards, select “Tag bort”.
 Bravida Integra field mapping

The service mainly transfers user data including related access tokens and entitlement assignments. The tables below show the default field mapping.

If needed, additional fields can be configured, using the SCIM API and useradditionalfield in the database configuration. 

User field mapping

By default, the following data is mapped between the USER table in the PACS Backend and the Integra service:  

SR NoPACS Backend field (Web API)Integra field (UI)
1Id (Id)ID (User ID Internal )
2givenname (givenName)FirstName (förnamn )
3familyname (FamilyName)lastName (efternamn)
4Check Type Configuration and then map actual email Type(emails-type-value)Emails (E-Post Address)
5Ssn (SSN Birthdate Part)Birthdate (Person Number first part)
6Ssn (SSN ControlNo Part)ControlNumber (Person Number second part)
7Default Configuration for ParentFolderPathParentFolderPath (Directory in which User is exported)

Access token field mapping

By default, the following data is mapped between the ACCESSTOKEN and ACCESSTOKENIDENTIFIER tables in the PACS Backend and the Integra service: 

SR NoPACS Backend field (Web API)Integra field (UI)
1CardNumber (identifiers-type-value)CardNumber (KortId)
2Configuration Card Profile (identifiers-type-value)CardSystemNumber (kortId)
3USER-PIN(No Direct link)PIN (PIN)
4Card ValidFrom and ValidTo decide internallyCardStatus (Status)

Entitlement assignment field mapping

By default, the following data is mapped between the ENTITLEMENTASSIGNMENT table in the PACS Backend and the Integra service: 

SR NoPACS Backend field (Web API)Integra field (UI)
1assigneeid (assignee -value)Card Holder ID (Selected User Name)
2ExternalId (ExternalId)AccessZoneId (AccessZone Id, not on UI)
3DisplayName (entitlement-DisplayName)Name (Namn)
 Apply configuration changes

Error rendering macro 'excerpt-include' : No link could be created for 'Apply configuration changes in PACS connector service'.

Install Integra Service

 Install Integra Service

The installation file is named IntegraService.exe.

Error rendering macro 'excerpt-include' : No link could be created for 'Install PACS connector service'.

 Restart service

The service SystemId is Integra. 

Error rendering macro 'excerpt-include' : No link could be created for 'Restart PACS connector service'.

Troubleshooting

 Troubleshooting

If attempts by the service to delete cardholders in Integra fail with an error such as “Can’t delete Card Holder which have connected cards”, make sure Integra is configured as explained above.

Related information


  • No labels

Copyright 2024 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions