GO Workforce service options

• Java Runtime 11 (there are multiple OpenJRE vendors which can be used for this purpose, such as Microsoft's own OpenJRE package)
• Outbound TCP 443 (TLS/HTTPS) to Internet
• Internal server/computer which is able to contact LDAP directory via port 389.

You will receive the Smart ID Agent (a Java application) from the GO Services delivery team, which contains all configuration you need.

To start the Smart ID Agent, either execute a Windows Batch file or a Shell script.

It is important that the Smart ID Agent application is running at all times for the synchronization features to work as expected and for the data to be transferred to our backend accordingly.

Smart ID Agent on Windows

Examples for the Smart ID Agent on Windows:

Example 1.
You can run it as a scheduled task to be executed upon startup using the Task Scheduler in Windows. Information about the Task Scheduler can be found here: https://learn.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler.

Example 2.
You can use opensource software to create a Windows Service and making it execute the Java application on system startup.

Smart ID Agent on Linux

You can create the Smart ID Agent as a service to make sure it starts up every time the server starts.

Either approach, you need to make sure that the application has the correct access to be able to write logs (in the same folder it is executed from) or the startup will fail. With either approach, you can also limit the application by running it as a specific user.

Limitations

Nexus GO Services is responsible for the application being able to be executed (manually test is usually performed by just running the Batch file or Shell script and functionality is verified), we do not setup nor alter any information on customer environments, we simply provide the application which needs to run.

When doing synchronization towards an LDAP, the following logic is applied for life cycle management.

• Unique identifier (such as GUID from AD LDAP) is used.
• A Organizational Unit (OU) for Active users is used.
• An Organizational Unit (OU) for Inactive users is used.
• When a user has moved into the Inactive users, it is deactivated in GO Services along with all certificates and credentials connected to it.
• If a user is deleted from the Active OU in the LDAP, it is considered an orphan and is no longer life-cycle managed. If this happens by mistake, you must restore the deleted user and move it into the inactive OU.

When using API as a user creation/management option, this is REST API based. For more information, see Identity Manager Process REST API.

When using manual and/or CSV as an option for user creation, there are no prerequisites. A template for CSV will be provided by the GO Services team.

With SAML (2.0) federation, there is an option to federate the customer Service Provider (SP) with the GO Services Identity Provider (IdP).

Metadata information

• Metadata information from the customer can be provided via an XML file or manually. 
• IdP Metadata will be provided from Nexus in a standard SAML XML file.

Required customer information

When federating with SAML, the following information is required from the customer: 

• Entity ID
• Service Provider URL

Signed authentication requests

Nexus requires signed authentication requests. To achieve that, the customer must set these values in the customer environment to which the federation shall be done:

• Sign Assertion: True
• Signing Digest Method: SHA256
• Digest Method: SHA256