Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... Manual de usuario

Novell

www.novell.com

novdocx (en) 11 December 2007

Identity Assurance Solution 3.0.2 Administration Guide

Identity Assurance Solution

3.0.2

February 15, 2008

ADMINISTRATION GUIDE

novdocx (en) 11 December 2007

Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 December 2007

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

novdocx (en) 11 December 2007

Contents 5

Contents

novdocx (en) 11 December 2007

About This Guide 7

1Overview 9

1.1 System-Wide Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.2 Agency-Specific Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3 What’s Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Managing System-Wide Roles 13

2.1 System Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.1.1 Add a User to a System-Wide Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.1.2 Remove a User from a System-Wide Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 System Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3 Activator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3.1 No Applicant Match for Shipped Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.3.2 Wrong Cards Shipped to Valid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

2.4 Registrar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3 Managing Agency-Specific Roles 15

3.1 Agency Sponsor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.1.2 Create a New User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.3 Delete a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.1.4 Display Applicant Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.1.5 Request Card Reissuance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.1.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.1.7 Sponsor New Applicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.1.8 Update Applicant Employment Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.2 Agency Adjudicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.2.1 Change To Adjudication Record (Manual) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3 Agency Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.3.2 Change PIV Card Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.3.3 Invalid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.3.4 Invalid Source Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.3.5 Impersonation Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.3.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4 Agency Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4.1 Add a User to an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.4.2 Remove a User from an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4 Troubleshooting 25

4.1 Known Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.1.1 Do Not Use Enter Key When Requesting Applicant Card. . . . . . . . . . . . . . . . . . . . . 25

4.1.2 Required Browser for IAS Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.1.3 COULD_NOT_FIND_USER Error While Retrieving User

AIMS_NO_SUCH_WALLET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

6Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

A IAS Administration Security 27

A.1 Signed Workflows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

A.2 Novell Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

A.3 Third-Party Products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

B Documentation Updates 29

B.1 February 8, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

B.1.1 Upgraded IAS from 3.0.1 to 3.0.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

B.1.2 Documentation Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

C Documentation Updates 31

C.1 February 15, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

C.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

About This Guide

novdocx (en) 11 December 2007

About This Guide

This guide provides information on performing basic administration tasks for the Identity Assurance

Solution.

Chapter 1, “Overview,” on page 9

Chapter 2, “Managing System-Wide Roles,” on page 13

Chapter 3, “Managing Agency-Specific Roles,” on page 15

Chapter 4, “Troubleshooting,” on page 25

Appendix A, “IAS Administration Security,” on page 27

Audience

This guide is intended for system administrators and system integrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Identity Assurance Solution Administration Guide, visit the

Identity Assurance Solution Documentation Web site (http://www.novell.com/documentation/

ias301/index.html).

Documentation Conventions

In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

Overview

novdocx (en) 11 December 2007

Overview

Novell®has partnered with third-party companies to build a solution that offers an integrated logical

and physical control system that complies with Homeland Security Presidential Directive 12

(HSPD-12). HSPD-12 directs the implementation of a new standardized badging process, which is

designed to enhance security, reduce identity fraud, and protect the personal privacy of users who

are issued government identification.

Identity Assurance Solution provides a complete system for managing the enrollment, issuance,

access control, and retirement of Personal Identification Verification (PIV) cards. This solution is in

compliance with the Federal Information Processing Standards Publication 201 (FIPS 201) and

provides components such as an Identity Management System (IDMS), a User Enrollment/

Biometric Capture system, a Card Management System (CMS), and Logical and Physical Access

Control Systems (LACS/PACS).

During the installation of the Identity Assurance Solution, several roles are created. These roles and

their associated tasks are based on the General Services Administration (GSA) standards. Those

users who are assigned to these roles can perform their tasks by using the User Application for

Provisioning through a Web browser.

This document outlines the roles and tasks performed by each role for the Identity Assurance

Solution.

1.1 System-Wide Roles

This solution includes the following system-wide roles:

Table 1-1 System-Wide Roles

System-Wide Role Description Tasks

System Role Administrator

For more information, see

Section 2.1, “System Role

Administrator,” on page 13.

Responsible for adding and removing

other users from roles in the system.

Can add or remove users from all

system-wide roles and from the

agency role administrator’s role for

each agency. Cannot add or remove

users from agency-specific roles.

Add a User to a System-

Wide Role

Remove a User from a

System-Wide Role

System Security Officer

For more information, see

Section 2.2, “System Security

Officer,” on page 14.

Responsible for viewing and

managing the audit log. Does not

have any specific workflow tasks but

is responsible to enforce the rules

and policies related to PIV card

requests, activations, and issuances.

No workflow tasks

10 Identity Assurance Solution 3.0.2 Administration Guide

novdocx (en) 11 December 2007

1.2 Agency-Specific Roles

This solution includes the following agency-specific roles:

Table 1-2 Agency-Specific Roles

Activator

For more information, see

Section 2.3, “Activator,” on

page 14.

Runs the CMS system. Responsible

for activating an applicant's PIV card

after it comes back from the card

production facility. Verifies the

applicant’s identity by using a

biometric scan and oversees the

personalization of the card by

generating keys, loading certificates

onto the card, and initializing the

card’s PIN number. Sends all this

information to the Identity Vault and

notifies the system that the card has

been issued.

No Applicant Match for

Shipped Cards

Section 2.3.2, “Wrong Cards

Shipped to Valid Address,”

on page 14

Registrar

For more information, see

Section 2.4, “Registrar,” on

page 14.

Runs the biometric enrollment

system. The registrar does the

identity-proofing and captures the

applicant’s identification information

and biometric data. This information

is forwarded to the Idenitity Vault.

No workflow tasks

Agency-Specific Role Description Tasks

Agency Sponsor

For more information, see

Section 3.1, “Agency

Sponsor,” on page 15.

Responsible for initiating a PIV card

request on behalf of an applicant and

is the only user that can initiate a PIV

card request. Updates an applicant's

employment status (terminated,

active, or suspended) and modifies

information about the applicant in the

system (change the applicant's

name, job title, etc.).

Card Destruction

Create a New User

Delete a User

Display Applicant

Information

Request Card Reissuance

Request Card Reprint

Sponsor New Applicant

Update Applicant

Employment Status

Agency Adjudicator

For more information, see

Section 3.2, “Agency

Adjudicator,” on page 20.

Responsible for performing

background checks on applicants. At

the end of the biometric enrollment

process, initiates an Automated

Fingerprint Identification System

(AFIS) check and the manually

performs a National Agency Check

with Inquiries (NACI) check or FBI

check. Based on the results of these

checks, determines if the card

request can proceed.

Change To Adjudication

Record (Manual)

System-Wide Role Description Tasks

Otros manuales para IDENTITY ASSURANCE SOLUTION 3.0.2 -...

Tabla de contenidos

Otros manuales de Software de Novell

Novell

Novell ZENWORKS PATCH MANAGEMENT 6.4 - S Manual de usuario

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Guía del usuario

Novell

Novell LINUX ENTERPRISE SERVER 10 - STORAGE ADMINISTRATION GUIDE... Manual de instrucciones

Novell

Novell GROUPWISE 8 - MONITOR Manual de usuario

Novell

Novell OPEN ENTERPRISE SERVER CLUSTER SERVICES 1.8.2 -... Manual de usuario

Novell

Novell SP2 - S Manual de instrucciones

Novell

Novell CLIENT FOR LINUX 2.0 Manual de usuario

Novell

Novell EVOLUTION 2.6 Manual de usuario

Novell

Novell IMANAGER 2.7.3 Manual de usuario

Novell

Novell APPARMOR 1.2 Manual de instrucciones

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Manual del operador

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 -... Manual de usuario

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 3 Manual de usuario

Novell

Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION... Manual de usuario

Novell

Novell CLIENT LOGIN EXTENSION 3.7 - ADMINISTRATION Manual de instrucciones

Novell

Novell SERVER CONSOLIDATION MIGRATION TOOLKIT 1.1 - ADMINISTRATION GUIDE... Manual de instrucciones

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Manual de usuario

Novell

Novell IDENTITY MANAGER 3.6.1 - JOBS GUIDE Manual de usuario

Novell

Novell GROUPWISE 8 - LIBRARIES AND DOCUMENTS Manual de usuario

Novell

Novell SENTINEL LOG MANAGER 1.0.0.5 - S Manual de instrucciones

Novell

Novell CLIENT 1.0 FOR LINUX - README Manual de usuario

Novell

Novell LINUX ENTERPRISE 11 - SUBSCRIPTION MANAGEMENT TOOL GUIDE... Manual de usuario

Novell

Novell GROUPWISE 7 - DOMAINS Manual de usuario

Novell

Novell GROUPWISE 7 WEBACCESS Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario

Lexmark

Lexmark Apps Manual de servicio