Nexus' software components have new names:

Nexus PRIME -> Smart ID Identity Manager
Nexus Certificate Manager -> Smart ID Certificate Manager
Nexus Hybrid Access Gateway -> Smart ID Digital Access component
Nexus Personal -> Smart ID clients

Go to Nexus homepage for overviews of Nexus' solutions, customer cases, news and more.


This article describes how to ensure that card encoding works properly, when an authenticating reverse proxy, such as Smart ID Digital Access component, is used in front of Smart ID Identity Manager. Certain Identity Manager endpoints must be allowed, as is described below. 


Expand/Collapse All

Example setup

In the following examples, it is assumed that you access Identity Manager Operator via the following external URL of the reverse proxy:

https://prime.with.hag/prime_explorer/


...which then connects to the internal Identity Manager server:

https://prime.internal:8443/prime_explorer/

Step-by-step instruction

To enable Card SDK to download the JPKIEncoder, you must allow the download endpoints for JAR files:

  1. Enable everything in the /eclnt/lib/ folder to pass through without authentication. For example: 

    Example with Digital Access component as reverse proxy
    https://prime.with.hag/prime_explorer/eclnt/lib/* 
    =>
    https://prime.internal:8443/prime_explorer/eclnt/lib/*

    This covers the following parts: 
    /prime_explorer/eclnt/lib//filelist - list of JARs to download

    /prime_explorer/eclnt/lib//*.jar - the actual JAR files listed in filelist

Make sure you use the correct syntax for your reverse proxy.

The CA connectors of Identity Manager use a session ID cookie embedded in the cardjob to allow the JPKIEncoder to authenticate any CA requests it has to make. The reverse proxy's authentication layer must allow the CA connector cookies without authentication. Calls will still be authenticated, via Identity Manager itself. 

  1. Enable everything in the /ws/ca_connectors/ folder to pass through without authentication. For example:  

    Example with Hybrid Access Gateway as reverse proxy
    https://prime.with.hag/prime_explorer/ws/ca_connectors/*
    =>
    https://prime.internal:8443/prime_explorer/ws/ca_connectors/*

Make sure you use the correct syntax for your reverse proxy.

Make sure that cookies, at least JSESSIONID, are forwarded on these endpoints.