/
Hybrid Access Gateway - Standard service tasks in Identity Manager
Document toolboxDocument toolbox

Nexus Documentation
CURL vulnerability information (CVE-2023-38545) - Nexus awareness advisory on Microsoft's update KB5014754

Hybrid Access Gateway - Standard service tasks in Identity Manager

Owned by Ann Base (Deactivated)
Last updated: Feb 07, 2024 by Josefin Klang (Deactivated)
3 min read

 

Description

Use this task to provision a user to Smart ID Digital Access component The task consists of two phases:

  • In the first phase the user will be created or updated. This will always be done.
    Note: If you do not set a validFrom field, the user always gets the current date as a valid from value in Digital Access

  • The second phase is about locking or unlocking the user:

 

  1. If the current state of the CoreObject matches a state in the lockedStates configuration, the user will be locked.

    • If Smart ID Mobile App (Personal Mobile)is configured, all Smart ID Mobile App profiles that the user has will be deleted.
      Note: Deletion of authentication methods SYNC and OATH are not implemented yet 

  2. If the current state of the CoreObject matches a state in the unlockedStates configuration, the user will be unlocked.

    • If Smart ID Mobile App is configured, the binary array of the barcode image (jpg) will be available in "personalimage". If unlocking of the user failed, the processmap will not contain the barcode.

    • If OATH is configured, the binary array of the barcode image (jpg) will be available in "oathActivationBarcode". If unlocking the user failed, the processmap will not contain the barcode.

    • If SYNC is configured, SYNC will be activated on Digital Access.

Configuration

To use this task, configure the following delegate expression in your service task:

${provisionUserToHagParameterizedTask}

The following parameters can be configured in PRIME Designer:

 Parameter

Mandatory

Value

Description

 Parameter

Mandatory

Value

Description

coreTemplateName

Example value:

  • Employee

The name of the coreTemplate from which the current coreObject state shall be retrieved.

challengePin

-

Example value:

  • 111111 (default)

The default PIN for synchronized authentication of the user in Digital Access.

emailField

-

Example value:

  • Employee_Email

The name of the datamap field which contains the email of the user.

hagUrl

Example value:

URL of Digital Access system.

locationDNField

-



The datamap field which contains the ldap dn to the desired user. If this is set the user will be connected to LDAP in Digital Access as well.

lockedStates

Example value:

  • "disabled,blacklisted,arrested"

A comma separated list of states from the stategraph of the user which mean "locked" in Digital Access.

unlockedStates

Example value:

  • "active"

A comma separated list of states from the stategraph of the user which mean "unlocked" in Digital Access.

userEnabledPerDefault

-

Valid values:

  • true (default)

  • false

If set to "true" the user will automatically be enabled in Digital Access. If not set it is handled as "true".

userNameField

Example value:

  • Employee_LastName

The datamap field which contains the user name that shall be provisioned to Digital Access.

smsNumberField

-

Example value:

  • Employee_SmsNumber

The datamap field which contains the phone/sms number of the user.

validFromField

-

Example value:

  • Employee_ValidFrom

The datamap field which contains the validFrom information. If it's not set or the value of the field is null the current Date will be used as this is a mandatory parameter in Digital Access.

validToField

-

Example value:

  • Employee_ValidTo

The datamap field which contains the validTo information.

authenticationMethods

-

Valid values:

  • Empty string (default)

  • SYNC

  • PM

  • OATH

The authentication methods which will be provided to Digital Access. Allowed are empty string (default), SYNC (= SYNChronized Authentication), PM (= Personal Mobile, that is, Smart ID Mobile App) and OATH (= Open AuTHentication).

Note: Only one authentication method can be selected.

  • If an empty string is configured, a user account will be created without an authentication method.

  • If PM is configured, the barcode Image (jpg) from the Digital Access response will be put to the process map with the fixed key "personalimage". If the creation fails, the field in the process map is not touched.

  • If OATH is configured, the barcode Image (jpg) from the Digital Access response will be put to the process map with the fixed key "oathActivationBarcode". If the creation fails, the field in the process map is not touched.

pmStatus

-

Valid values:

  • Empty string (default)

  • activate

  • deactivate

What status Personal Mobile, that is, Smart ID Mobile App, should get. If an invalid status is configured, the status in PM is not changed.

Note: This parameter is only mandatory if the authentication method is configured as PM. Otherwise it can remain empty.



OATHProvider

-

Example values:

  • Empty string (default)

  • Predefined_hotp_HmacSHA1

  • Predefined_hotp_HmacSHA256

  • Predefined_hotp_HmacSHA512

  • Predefined_totp_HmacSHA1

  • Predefined_totp_HmacSHA256

  • Predefined_totp_HmacSHA512

The providers are configured in the Digital Access system. To find out which providers are configured on your Digital Access system, go to Digital Access Admin > Manage System > OATH Configuration > Manage OATH Providers.

For more info, see: Set up OATH tokens in Digital Access.

Note: This parameter is only mandatory if the authentication method is configured as OATH. Otherwise it can remain empty.

Related content

Copyright 2024 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions