Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... User manual

Novell

www.novell.com

novdocx (en) 11 December 2007

Identity Assurance Solution 3.0.2 Administration Guide

Identity Assurance Solution

3.0.2

February 15, 2008

ADMINISTRATION GUIDE

novdocx (en) 11 December 2007

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 December 2007

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (en) 11 December 2007

Contents 5

Contents

novdocx (en) 11 December 2007

About This Guide 7

1Overview 9

1.1 System-Wide Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2 Agency-Specific Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3 What’s Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Managing System-Wide Roles 13

2.1 System Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.1.1 Add a User to a System-Wide Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.1.2 Remove a User from a System-Wide Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 System Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3 Activator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3.1 No Applicant Match for Shipped Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3.2 Wrong Cards Shipped to Valid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.4 Registrar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Managing Agency-Specific Roles 15

3.1 Agency Sponsor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.2 Create a New User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.3 Delete a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.4 Display Applicant Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.1.5 Request Card Reissuance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.1.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.1.7 Sponsor New Applicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.1.8 Update Applicant Employment Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.2 Agency Adjudicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.2.1 Change To Adjudication Record (Manual) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3 Agency Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3.2 Change PIV Card Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.3.3 Invalid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.3.4 Invalid Source Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.3.5 Impersonation Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.3.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4 Agency Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4.1 Add a User to an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4.2 Remove a User from an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4 Troubleshooting 25

4.1 Known Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.1.1 Do Not Use Enter Key When Requesting Applicant Card. . . . . . . . . . . . . . . . . . . . . 25

4.1.2 Required Browser for IAS Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.1.3 COULD_NOT_FIND_USER Error While Retrieving User

AIMS_NO_SUCH_WALLET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

6Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

A IAS Administration Security 27

A.1 Signed Workflows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

A.2 Novell Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

A.3 Third-Party Products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

B Documentation Updates 29

B.1 February 8, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

B.1.1 Upgraded IAS from 3.0.1 to 3.0.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

B.1.2 Documentation Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

C Documentation Updates 31

C.1 February 15, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

C.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

About This Guide

novdocx (en) 11 December 2007

About This Guide

This guide provides information on performing basic administration tasks for the Identity Assurance

Solution.

Chapter 1, “Overview,” on page 9

Chapter 2, “Managing System-Wide Roles,” on page 13

Chapter 3, “Managing Agency-Specific Roles,” on page 15

Chapter 4, “Troubleshooting,” on page 25

Appendix A, “IAS Administration Security,” on page 27

Audience

This guide is intended for system administrators and system integrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Identity Assurance Solution Administration Guide, visit the

Identity Assurance Solution Documentation Web site (http://www.novell.com/documentation/

ias301/index.html).

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

Overview

novdocx (en) 11 December 2007

Overview

Novell®has partnered with third-party companies to build a solution that offers an integrated logical

and physical control system that complies with Homeland Security Presidential Directive 12

(HSPD-12). HSPD-12 directs the implementation of a new standardized badging process, which is

designed to enhance security, reduce identity fraud, and protect the personal privacy of users who

are issued government identification.

Identity Assurance Solution provides a complete system for managing the enrollment, issuance,

access control, and retirement of Personal Identification Verification (PIV) cards. This solution is in

compliance with the Federal Information Processing Standards Publication 201 (FIPS 201) and

provides components such as an Identity Management System (IDMS), a User Enrollment/

Biometric Capture system, a Card Management System (CMS), and Logical and Physical Access

Control Systems (LACS/PACS).

During the installation of the Identity Assurance Solution, several roles are created. These roles and

their associated tasks are based on the General Services Administration (GSA) standards. Those

users who are assigned to these roles can perform their tasks by using the User Application for

Provisioning through a Web browser.

This document outlines the roles and tasks performed by each role for the Identity Assurance

Solution.

1.1 System-Wide Roles

This solution includes the following system-wide roles:

Table 1-1 System-Wide Roles

System-Wide Role Description Tasks

System Role Administrator

For more information, see

Section 2.1, “System Role

Administrator,” on page 13.

Responsible for adding and removing

other users from roles in the system.

Can add or remove users from all

system-wide roles and from the

agency role administrator’s role for

each agency. Cannot add or remove

users from agency-specific roles.

Add a User to a System-

Wide Role

Remove a User from a

System-Wide Role

System Security Officer

For more information, see

Section 2.2, “System Security

Officer,” on page 14.

Responsible for viewing and

managing the audit log. Does not

have any specific workflow tasks but

is responsible to enforce the rules

and policies related to PIV card

requests, activations, and issuances.

No workflow tasks

10 Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

1.2 Agency-Specific Roles

This solution includes the following agency-specific roles:

Table 1-2 Agency-Specific Roles

Activator

For more information, see

Section 2.3, “Activator,” on

page 14.

Runs the CMS system. Responsible

for activating an applicant's PIV card

after it comes back from the card

production facility. Verifies the

applicant’s identity by using a

biometric scan and oversees the

personalization of the card by

generating keys, loading certificates

onto the card, and initializing the

card’s PIN number. Sends all this

information to the Identity Vault and

notifies the system that the card has

been issued.

No Applicant Match for

Shipped Cards

Section 2.3.2, “Wrong Cards

Shipped to Valid Address,”

on page 14

Registrar

For more information, see

Section 2.4, “Registrar,” on

page 14.

Runs the biometric enrollment

system. The registrar does the

identity-proofing and captures the

applicant’s identification information

and biometric data. This information

is forwarded to the Idenitity Vault.

No workflow tasks

Agency-Specific Role Description Tasks

Agency Sponsor

For more information, see

Section 3.1, “Agency

Sponsor,” on page 15.

Responsible for initiating a PIV card

request on behalf of an applicant and

is the only user that can initiate a PIV

card request. Updates an applicant's

employment status (terminated,

active, or suspended) and modifies

information about the applicant in the

system (change the applicant's

name, job title, etc.).

Card Destruction

Create a New User

Delete a User

Display Applicant

Information

Request Card Reissuance

Request Card Reprint

Sponsor New Applicant

Update Applicant

Employment Status

Agency Adjudicator

For more information, see

Section 3.2, “Agency

Adjudicator,” on page 20.

Responsible for performing

background checks on applicants. At

the end of the biometric enrollment

process, initiates an Automated

Fingerprint Identification System

(AFIS) check and the manually

performs a National Agency Check

with Inquiries (NACI) check or FBI

check. Based on the results of these

checks, determines if the card

request can proceed.

Change To Adjudication

Record (Manual)

System-Wide Role Description Tasks

Other manuals for IDENTITY ASSURANCE SOLUTION 3.0.2 -...

Table of contents

Other Novell Software manuals

Novell

Novell GROUPWISE 8 - INTERNET AGENT User manual

Novell

Novell LINUX ENTERPRISE 10 SP1 - LINUX AUDIT User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell BUSINESS CONTINUITY CLUSTERING 1.1 SP2 -... Instruction Manual

Novell

Novell GROUPWISE 8 - LINUX-MAC CLIENT User manual

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.4 - S Instruction Manual

Novell

Novell IFOLDER 3 - ADMINISTRATION User manual

Novell

Novell GROUPWISE 7 - INTERNET AGENT User manual

Novell

Novell DATA SYNCHRONIZER - 07-2010 User manual

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.2 IR2 - ... User manual

Novell

Novell APPARMOR 1.2 Instruction Manual

Novell

Novell IDENTITY MANAGER 3.6.1 - UNDERSTANDING POLICIES... User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - GNOME... User manual

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION User manual

Novell

Novell EDIRECTORY 8.8 SP2 User manual

Novell

Novell CLIENT FOR LINUX 2.0 SP2 - 03-2009 User manual

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... User manual

Novell

Novell IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1 -... User manual

Novell

Novell GROUPWISE 8 - DATABASES User manual

Novell

Novell GROUPWISE 7 - LIBRARIES AND DOCUMENTS User manual

Novell

Novell ACCESS MANAGER 3.1 SP2 - README 2010 User manual

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 -... User manual

Novell

Novell GROUPWISE 7 - INTEROPERABILITY GUIDE User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 - ARCHITECTURE-SPECIFIC INFORMATION... Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide