Preface
Overview
Enterprise Access Management Concepts
EAM Controllers
A Multi-Domain Architecture
Interface general design
Authenticating to EAM Console and Managing Protection Modes
Searching the Directory Tree
Managing administrators
Administration Modes - Presentation
Delegating Administration Roles
Managing Administration Profiles
Transferring an Administration Role
Deleting an Administration Role
Displaying your Administration Role
Modifying the Parent Administrator
Adding/Removing Primary Administrators
Managing Security Profiles
Managing time slices
Managing directory objects
Creating/Modifying Time Slices
Configuring Time Slices
Displaying time slice usage logs
Displaying time slice event logs
Renaming representative objects
Deleting time slices
Managing Password Format Control Policies
Creating/Modifying Password Format Control Policies
Configuring Password Format Control Policy
Displaying PFCP usage logs
Displaying Password Format Control Policy Event Logs
Renaming Password Format Control Policies
Deleting Password Format Control Policies
Managing User Security Profiles
Creating/Modifying User Security Profiles
Configuring User Security Profiles
Managing Access Point Security Profiles
Authentication Tab
Security Tab
SSO and Notes Tab
Cloud Tab
Unlocking Tab (Fast User Switching - FUS)
Self Service Password Request Tab
Biometrics Tab
Session Delegation Tab
Audit Tab
OTP Tab
Mobile Device Tab
Displaying User Security Profile Usage Logs
Displaying User Security Profile Event Logs
Renaming User Security Profiles
Deleting User Security Profiles
Creating/Modifying Access Point Security Profiles
Configuring Access Point Security Profiles
Managing Application Security Profiles
Security Services Tab
Authentication Manager Tab
Enterprise SSO Tab
Multi-User Desktop Tab
Biometrics Tab
Self Service Password Request Tab
Active RFID Tab
Audit Tab
Local Administrators Tab
Displaying Access Point Security Profile Usage Logs
Displaying Access Point Security Profile Event Logs
Renaming Access Point Security Profiles
Deleting Access Point Security Profiles
Managing Password Generation Policies
Defining Security Profiles Default Values
Managing User and Access Point Security Profiles Priorities
Creating/Modifying Password Generation Policies
Configuring the Password Generation Policy
Displaying Password Generation Policy Usage Logs
Displaying Password Generation Policy Event Logs
Renaming Password Generation Policies
Deleting Password Generation Policies
Creating/Modifying Application Security Profiles
Configuring Application Security Profiles
Displaying Application Security Profile Usage Logs
Displaying Application Security Profile Event Logs
Renaming Application Security Profiles
Deleting Application Security Profiles
Managing applications
Importing/Exporting security profiles and directory objects
Managing smart cards
Creating an application
Defining the general properties of an application
Creating the account properties for an application
Defining the Single Sign-On properties of an application (SSO)
Defining external names
Defining the Provisioning Connector
Assigning users to an application
Sharing the administration of an application
Generating/Importing accounts for an application
Assigning access points to an application
Displaying accounts associated with the application
Displaying application event logs
Displaying/Modifying application information
Renaming applications
Deleting applications
Managing users
Displaying general information about the user
Defining user connection parameters
Managing access points
Suspending or limiting temporarily user access
Displaying user authentication information and administering roaming sessions
Predefining a new user's primary password
Managing user Self Service Password Request
Defining an audit identifier
Creating a welcome message
Assigning a user security profile
Declaring a user as administrator
Assigning/forbidding access points to a user
Managing user accounts
Managing the User Self Enrollment
Assigning Administration Rights
Configuring the Dedicated Organizational Units
Configuring Self Enrollment
Sending SSO account passwords to users
Sending primary password expiration notification emails to users
Defining additional security parameters for groups of users
Managing user smart cards
Managing user Mobile Devices
Displaying and deleting user biometrics data
Assigning applications to a user
Displaying delegated sessions
Managing user RFID tokens
Displaying user event logs
Deleting SSO data of disabled user accounts
Adding or removing a user from a group
Displaying general information about the access point
Defining access point configuration parameters
Managing representative objects
Assigning an access point security profile
Managing EAM controller services
Assigning a generic account to an access point
Assigning/forbidding users to an access point
Assigning/forbidding applications to an access point
Adding or removing an access point from a group
Analyzing Errors of a Remote Access Point
Displaying access point event logs
Updating manually an access point
Managing inbound representative objects
Managing clusters of access points
Creating/Modifying an inbound representative object
Defining the set of users to represent
Assigning a user security profile to the inbound representative object
Selecting access points available to the representative
Managing outbound representative objects
Creating/Modifying an outbound representative object
Defining the set of access points to represent
Selecting applications available to the representative
Displaying representative event logs
Renaming representative objects
Deleting representative objects
Creating and configuring a cluster of access points
Managing user permissions on clusters
Selecting a domain controller
Authorizing users to access the workstations of the cluster
Displaying the cluster composed by authorized users
Displaying cluster event logs
Renaming clusters
Deleting cluster
Configuring smart card parameters of use
Managing SA server devices
Managing RFID tokens
Managing smart card configuration profiles
Managing smart card certificates
Assigning smart cards (except loan cards)
Creating/Modifying configuration profiles
Renaming a configuration profile
Deleting a configuration profile
Modifying authentication parameters of an assigned smart card
Managing batches of smart cards
Assigning smart cards
Assigning a smart card managed by an external CMS
Smart card self enrollment
Formatting an assigned smart card
Managing loan cards
Unlocking smart cards
Setting administrator's contact information
Unlocking to Forcing PIN
Unlocking by secret code
Unlocking by SSPR
Unlocking by extending the validity duration
Formatting a blacklisted card
Managing lost or theft smart cards
Formatting smart cards
Displaying information
Exporting Generated Reports
Assigning an RFID token
Locking and unlocking an RFID token
Managing biometrics
Locking and unlocking an RFID token from the Directory panel
Locking and unlocking an RFID token from the RFID panel
Resetting the PIN of an RFID badge
Blacklisting and deleting an RFID token
Blacklisting and deleting an RFID token from the Directory panel
Blacklisting and deleting an RFID token from the RFID panel
Modifying the detection areas and the grace period
Exporting a list of RFID tokens
Defining the biometric enrollment policy
Defining the workstation biometric parameters
Managing the user enrollment
Displaying and exporting the biometric enrollment report
Managing Mobile Devices
Enabling the public key authentication method
Configuring user and access point security profiles to support the PKA authentication method
Activating the PKA authentication method and defining the set of authorized certification authorities
Managing Emergency Accesses
Managing audit events
Activating the PKA authentication method
Configuring the set of authorized certification authorities
Configuring the automatic update of the revocation information
Displaying audit events
Defining an audit population
Managing and assigning audit filters
Interpreting audit events
Managing reports
The audit main window
The "Event details" window
Detailed information on the audit administration events
Exporting audit events
Archiving audit records
Retrieving user identifier from audit identifier
Retrieving audit events
Generating PDF reports
Generating On-screen reports
Customizing configuration files
Creating scripts
Basic syntax of regular expressions
Listing audit events and error codes
Correspondence between profiles and administration rights
Report Models and Parameters List
Custom Group Files Format
Managing lost or theft smart cards
Managing lost or theft smart cards
|
Task to perform |
In classic administration mode, you must have: |
In advanced administration mode, you must have: |
|
Disabling temporarily smart cards |
"Smart card administrator" and at least "Security object administrator" or "access" or "rights" |
"Token: Modification" and "Directory: Browsing" |
|
Sending smart cards to a blacklist |
"Smart card administrator" and at least "Security object administrator" or "access" or "rights" |
"Token: Blacklist" and "Directory: Browsing" |
In this section:
Disabling/enabling temporarily smart cards
Managing smart cards > Managing lost or theft smart cards > Disabling/enabling temporarily smart cards
Disabling/enabling temporarily smart cards
Subject
You can temporarily disable a smart card (when a user forgets his/her card, for example). The temporary deactivation allows you to make a smart card disabled but without deleting its assignment.
Procedures
From the Smart Card panel
- In the Smart Card panel, click the Reports tab.
- In the displayed window, filter if needed the smart cards to display and click Apply.
- Select the wanted smart card and click Disable/Enable.
- The smart card is now disabled.
From the Directory panel
- In the tree structure of the Directory panel, select the user for which you want to unlock a smart card.
- In the Smart Card tab, click the Disable/Enable button.
- The smart card is now disabled.
Blacklisting smart cards
Blacklisting smart cards
Subject
When a smart card is blacklisted, it is no longer usable. It is possible to remove a card from the black list and to assign/format it again to make it usable again.
|
|
NOTE: If the card is removed from the black list from the EAM console, it may not be possible to format it (the PUK is no longer known by EAM); you are advised to format the card whereas it is blacklisted. |
Procedures
From the Smart Card panel
- In the Smart Card panel, click the Reports tab.
- In the displayed window, filter if needed the smart cards to display and click Apply.
- Select the wanted smart card and click Blacklist.
- A confirmation window appears.
- Validate information.
- The smart card is blacklisted.
From the Directory panel
- In the tree structure of the Directory panel, select the user for which you want to blacklist a smart card.
- Select the wanted smart card and click the Blacklist button.
- A confirmation window appears.
- Validate information.
- The smart card is blacklisted.
NOTE: To get more information on the administrator who performed this operation and the date when it occurs, just click the Blacklist tab.
- The smart card is blacklisted.
Assigning a loan card
Assigning a loan card
When a user has forgotten, lost his/her smart card or when his/her smart card has been stolen, you can assign him/her a loan card. In this case, the principal card of the user is deactivated: a user can only have one active card at a time. The assignment procedure is described in Section Modifying authentication parameters of an assigned smart card.