This article describes how to connect Smart ID Identity Manager to the Smart ID Digital Access component Extension Programming Interface (XPI), to enable provisioning of users and Smart ID Mobile App profiles.
To be able to use the Digital Access XPI interface, an SSL server certificates needs to be provided. For demo use cases it’s sufficient to create a self-signed certificate including private keys. Skip these steps if a real server certificate exists.
Use the java keytool command to create a self-signed certificate including private keys:
To use the Digital Access server certificate, a p12 container is required with the corresponding certificate. Use the created jks container to transform to p12:
Extract the certificate:
Extract the key:
To install the server certificate in Digital Access component:
- Log in to Digital Access Admin and go to Manage System > Certificates.
- In the section Server Certificates, click Add Server Certificate…
Fill out the required information, for example:
Click ? for more information.
- Click Next > to finish the wizard.
The server certificate needs to be added to the trust store, to make the Identity Manager server trust the certificate during the XPI call.
Add the certificate to the cacerts file of the Java version that the Identity Manager server runs with.
Make sure to use the right Java version.
The default password of the the cacerts keystore is
An Authentication Method of type Password must be set up, so that Identity Manager can authenticate against Digital Access XPI.
- Log in to Digital Access Admin and go to Manage System > Authentication Method.
- Click Add Authentication Method…
Check Nexus Password.
- Click Next >.
Enter a Display Name, that is, the name to identify the method for example on the portal.
If the password authentication method is only to be used for XPI authentication, uncheck Visible in authentication menu.
In the following form, add the default authentication method server, by clicking Add Authentication Method Server... and then Next >.
Click Next > until the wizard is finished and the password authentication method is created.
To authenticate to the XPI with username and password, a delegated administrator must be defined. The user must be in the already connected user storage. See Add user storage in Digital Access for more information.
To assign the delegated administrator role to a user:
- Log in to Digital Access Admin and go to Manage System > Delegated Management.
- Click Super Administrator and go to the tab Administrators.
- Register the user by clicking Add Administrator… Type in the username from the user storage and click Search.
- Go to Manage Account and Storage > User Accounts. to define the password for the user account.
In User ID, enter the user name, or a part of it with wildcards, for example xpi*. Click Search to search for the user and click the corresponding user in the search results.
On the tab PortWise Authentication, check Enable PortWise Password for the user account.
Provide a password of the user for authentication to the XPI, in either of the following ways:
Enter a password in Password and Verify Password.
Check Use password from User storage. to use the LDAP password.
For Identity Manager to get access to Digital Access component over the XPI, the XPI must be enabled.
To enable the Digital Access XPI:
- Log in to Digital Access Admin and go to Manage System > Policy Services.
- Click the link to the configured Registered Policy Services.
- Go to the section XPI:REST and WS. Check Enable XPI:WS.
- Enter the following information:
- In Host, enter the IP address or DNS name of the Digital Access appliance.
- In Server Certificate, select the certificate that was added before, for example
To enter the Digital Access XPI credentials in Identity Manager:
- Open Identity Manager operator UI, and go to Admin > Configure System Properties > HAG Settings.
- Enter the following data:
- In User and Password, enter the details of the user that was set up as Super Administrator in Digital Access.
- In Authentication Method ID, enter the ID of the authentication method from Digital Access.
In this example from Digital Access, the Authentication Method ID is
- Click Save.
To define which data should be provision from Identity Manager to Digital Access, the settings in the Digital Access provisioning task must be adapted. For more information, see
provisionUserToHagParameterizedTask in Standard service tasks in Identity Manager.
The task is used in the Identity Manager processes that provision the data to Digital Access. There are processes available in the Base configuration package (BIM), called BaseProcActivateAndProvisionUserToHag and BaseProcDeactivateAndProvisionUserToHag.
To adapt the settings in the Digital Access provisioning task, do the following for each process:
- Open the process, for example BaseProcActivateAndProvisionUserToHag.
- Click the edit icon on the corresponding task. The available parameters are displayed.
- Enter parameter values:
- In hagUrl, provide the host and port information.
Since Identity Manager is communicating with Digital Access over HTTPS we need to make sure the configured host provides a corresponding SSL certificate. See Install Server Certificate and Trust Server Certificate above.
- Adapt the other fields to reflect the Identity Manager configuration. For more information on the parameters, see
provisionUserToHagParameterizedTaskin Standard service tasks in Identity Manager.
- In hagUrl, provide the host and port information.