Description

Use this task to run a search on the Nexus GO Cards ordering API to get the status of an order which was previously launched through Nexus GO Cards production.

Configuration

To use this task, configure the following delegate expression in your service task:

${caasCardOrderStatusAction}

The following parameters can be configured in Identity Manager Admin:

When the status order is retrieved from Nexus GO Cards, the RFIDs readouts can have multiple entries for the same type.

For example:

{
    "foundCount": "1",
    "order": {
        "orderId": "3541415",
        "created": "2018-08-29 13:51:02",
        "orderStatus": "Valid",
        "orderStatusId": "1",
        "cardNumber": "BB-1808-636328",
        "layoutId": "147424",
        "productionDate": "2018-08-29",
        "validThru": "2023-08-29",
        "personName": "Demo, Dynamics",
        "readouts": [
            {
                "type": "EM_HEX_LSB",
                "uid": "9876543"
            },
            {
                "type": "EM_HEX_MSB",
                "uid": "12345678"
            }
        ]
    }
}

For these cases, the first value of the same type is used (EM_HEX_LSB and EM_HEX_MSB are considered to be of the same type).

Description

Use this task to execute card productions on the server side. The service tasks supports execution of encodings via Card SDK or the JPKIEncoder integrated in Identity Manager. Printing is currently not supported.

Configuration

To use this task, configure the following delegate expression in your service task:

${serverSideCardOperationTask}

The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to trigger a republishing or unpublishing action for a specific certificate on the Smart ID Certificate Manager (CM) based on the configured publication procedure.

Configuration

To use this task, configure the following delegate expression in your service task:

${certificatesPublicationTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to create an ACME pre-registration order in Smart ID Certificate Manager (CM). You need to use Smart ID Certificate Manager 8.1 or later.

Configuration

To use this task, configure the following delegate expression in your service task:

${acmePreRegistrationTask}

The following parameters can be configured in Identity Manager Admin: 

Description 

Use this task to register or de-register CMP order requests in Smart ID Certificate Manager (CM).

The task sends common name and password details for specified token procedure into CM, so that CM will later accept (in case of registration) or reject (in case of de-registration) CMP enrollment request from specified clients. This service task parameters can be extended for other certificate attributes, which are listed below.

Configuration

To use this task, configure the following delegate expression in your service task:

${cmpOrderRequestTask}

The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to register or de-register Enrollment over Secure Transport (EST) order requests to Smart ID Certificate Manager (CM).

The task sends common name and password details for specified token procedure into CM, so that CM will later accept (in case of registration) or reject (in case of de-registration) EST enrollment request from specified clients. This service task parameters can be extended for other  certificate attributes which is listed below.

Configuration

To use this task, configure the following delegate expression in your service task:

${estOrderRequestTask}

The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to register or de-register Simple Certificate Enrollment Protocol (SCEP) order requests to Smart ID Certificate Manager (CM). 

The task will be executed on server identities and use some details of the server identities for creating order request. The task sends common name and password details for specified token procedure into CM, so that CM will later accept (in case of registration) or reject (in case of de-registration)  SCEP enrolment request from specified clients. This service task parameters can be extended for other  certificate attributes which is listed below.

Configuration

To use this task, configure the following delegate expression in your service task:

${scepOrderRequestTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to send a PKCS#10 to the configured CA. Based on the configured certificate template a new X.509 certificate will be requested from the CA. The issued certificate will be stored in the Identity Manager database and will be added to the process map. Certificate templates provide a set of attributes, which allows fine-grained configuration.

Configuration

To use this task, configure the following delegate expression in your service task:

${executePKCS10RequestTask}

The following parameters can be configured in Identity Manager Admin:

Update Note

Description

Use this task to send a certificate request based on extracted PKCS#10 data (via Cert: Extract PKCS#10 Attributes From Request) combined with certificate template data. Mapped Certificate data-pool field values in the certificate template can be populated with extracted PKCS#10 data or set to custom values. Based on the configured certificate template a new X.509 certificate will be requested from the CA. The issued certificate will be stored in the Identity Manager database and will be added to the process map. Certificate templates provide a set of attributes, which allows fine-grained configuration.

Configuration

To use this task, configure the following delegate expression in your service task:

${executeModifiedPKCS10RequestTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to extract attributes from a certificate. 

Configuration

To use this task, configure the following delegate expression in your service task:

${extractCertAttributesTask}

The following parameters can be configured in Identity Manager Admin:

In case of error

The following parameters are set in case of error:

* - These parameters require PRIME 3.12.4 or later.

Description

Use this task to extract all subject DN attributes, as well as the SAN attributes from a PKCS#10 request. The parameter value of P10RequestFormEntry has to match the symbolic name of the field in the PKCS10RequestEntryForm where the CSR file is uploaded. The extracted attributes will be put into the process data map under keys <valueOfP10RequestFormEntry><attributeName>, for example, PKCS10RequestFormEntryCn for the default value of P10RequestFormEntry and CN attribute or PKCS10RequestFormEntrySANEMAIL for San Email.

Configuration

To use this task, configure the following delegate expression in your service task:

${extractPKCS10AttributesFromRequestTask}

The following parameters can be configured in Identity Manager Admin

Extracted attributes

_{*Extracting the curve name currently does not work if Identity Manager and Identity Manager Admin run on the same Tomcat instance due to a classloader issue with JCE providers. In that case only the algorithm name is shown ("ECDSA") without the curve appended.}

Description

Use this task to fetch the IDs of the latest certificates to be recovered and put them in the process map in a format suitable for key recovery. The user whose certificates will be fetched, is the user found in the process map. The certificates that will be fetched are the <count> latest certificates of type <certTemplate> related via ObjectRelations directly to the user or related over a Card to the user.

SKI (Secure Key Injection): It will look for associated cards of the person and retrieve thumbprint information if the card ICCSN is provided in the process map. This thumbprint will be saved into the process map if it is available in the database.

Configuration

To use this task, configure the following delegate expression in your service task:

${prepareDataForCertificateKeyRecoveryTask}

The following parameters can be configured in Identity Manager Admin: 

To use this task, select it in Identity Manager Admin and configure the above parameters. No bean configuration is required. In a later action you must perform the Key Recovery.

Description

Use this task to archive and/or recover PGP certificates from Smart ID Certificate Manager (CM).

When new certificates are requested, the values will be taken from the certificate template configured under "archivalTemplate". The following attributes can be set:

Configuration

To use this task, configure the following delegate expression in your service task:

${executePgpSoftTokenAction}

The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to query a certificate from a certificate authority, put it into a PKCS#12 Container and either save it to secret field store or send it via email. There are two ways to query the data base:

• Recover the certificates found in process variable.
• Request a new certificate (using a plain request).

Both methods can be combined or used independently. If no certificate is queried the task will fail.

Configuration

To use this task, configure the following delegate expression in your service task:

${executeSoftTokenRequestAndRecovery2}

The following parameters can be configured in Identity Manager Admin: 

Parameter	Mandatory	Value	Description
p12PasswordField		Example value: Person_PasswordRef	Password variable field for the generated PKCS#12 container. There are actions to create one.
recoverCerts		Valid values: true (default) false	Whether recovery should be executed.
processVariable	If recoverCerts = true	Example value: Certificate_CoreObjects	Process variable containing the core object ID (or list of IDs) or core object descriptor list of the certificates to recover.
recoveryTemplate	-	Example value: Revocery	Certificate template used for recovery. Not necessary for some CAs.
requestCert		Valid values: true (default) false	Whether a new certificate should be requested (Plain request).
certTemplate	If requestCert = true	Example value: MyCertTemplate	Certificate template used for requesting the new certificate.
includeChain	-	Valid values: true (default) false	If present and set to false, the certificate chain is skipped and only end-entity certificates will be included.
keyArchival		Valid values: true (default) false	Whether the created key are archived in the CA.
mailDefinitionName	-	Example value: MyMailDefinition	If empty, no mail is sent.
encryptionCertificates	-		The core object descriptor list of the certificates used for email encryption.
p12RefField	-	Example value: Person_Softtoken	Field to store PKCS#12 container in Base64 encoding.
errorMessageField		Example value: ErrorMessage	Field to store the human readable message in case of error.
errorTypeField		Example value: ErrorType	Field to store error type (ERROR, CA_ERROR or MAIL_ERROR).
certsToRevokeField		Example value: CertsToRevoke	In case of error, the newly created certificates are stored as list of core object ids. These certificates can in turn be revoked by the process if desired.
p12EncryptionAlgo	-	Valid values: PBE with SHA-1 and 3-key triple DES with CBC (OID: 1.2.840.113549.1.12.1.3) AES 256 with CBC (OID: 2.16.840.1.101.3.4.1.42) Default value: AES 256 with CBC (OID: 2.16.840.1.101.3.4.1.42)	The encryption algorithm to use for the PKCS#12 keystore.
p12EncryptionIterations	-	Default value: 100000	The encryption iterations
p12PseudoRandomFunction	-	Valid values: HMac with SHA-1 (OID: 1.2.840.113549.2.7) HMac with SHA-256 (OID: 1.2.840.113549.2.9) Default value: HMac with SHA-256 (OID: 1.2.840.113549.2.9)	The PRF to use for the PKCS#12 keystore
p12HashAlgo	-	Valid values: SHA-1 (OID: 1.3.14.3.2.26) SHA-256 (OID: 2.16.840.1.101.3.4.2.1) Default value: SHA-256 (OID: 2.16.840.1.101.3.4.2.1)	The hashing (MAC) algorithm to use for the PKCS#12 keystore
p12HashIterations	-	Default value: 100000	The hashing (MAC) iterations

Description

Use this task to revoke an existing certificate. This task needs to be executed on a Certificate object or with Certificate data available in the process map.

Configuration

To use this task, configure the following delegate expression in your service task:

${revokeCertificateTask}

The following parameters can be configured in Identity Manager Admin:

certificateDataPool

targetState

Description

Use this task to trigger a republishing or unpublishing action for a specific PGP certificate on Smart ID Certificate Manager (CM), based on the configured publication procedure.

Configuration

To use this task, configure the following delegate expression in your service task:

${pgpCertificatesPublicationTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to create a new domain request in the QuoVadis Certificate Authority. It is saved as a request core-object in a dedicated data-pool.

Prerequisites

Data-pool

1. The data-pool must have the fields shown below. Pay special attention to the name of the Meta_CoreObjectState_-field which needs to end with the matching data-pool name:
   
2. Note the field TransactionId which is used to store a UUID assigned by QuoVadis to each domain request. It is required to later query the status of the request.
   Usually the internal Requests table is used as data-source as shown below:
   

State-graph

1. The state-graph must contain at least the following states: pending/approved/rejected (case-insensitive), with transitions from pending to both approved and rejected.
2. If you want to disambiguate requests that did not yet have their state queried at the CA from those which are pending according to the CA, then add a start state sent before pending, as shown below, but this is optional (pending will be the start state when not using sent).
   

Request core-template

1. You need a request core-template which uses the above data-pool and state-graph definitions:
   
   

Search-configuration (optional)

1. Optionally you may configure a search-configuration for your request core-objects, for example, like this:
   

Configuration

To use this task, configure the following delegate expression in your service task:

${quoVadisRequestDomainParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to query the status of a QuoVadis domain request in the Certificate Authority and update the state of the request core-object in Identity Manager accordingly.
This task requires a QuoVadis domain request core-object to be loaded into the process map before execution.

Prerequisites

The prerequisites of the Cert QuoVadis PKI: Create domain request task above also apply here.

Configuration

To use this task, configure the following delegate expression in your service task:

${quoVadisUpdateDomainRequestStatusParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to save account domain list from QuoVadis Certificate Authority into Identity Manager lookup table. This task deletes the old domain list entry and creates a fresh entry in the configured lookup table.

Prerequisites

Create a lookup table-based datapool and core template name for storing the domain list information into Identity Manager.

Datapool

1. The datapool must have the fields with the described names as shown in this figure. This field names are fixed and taken from DomainInfo response.
   
   
2. Configure the datapool datasource as lookup table as shown in this figure:

Lookup table

1. Create a lookup table which belongs to the Domain data pool. Any state graph can be assigned to this lookup table. 

Configuration

To use this task, configure the following delegate expression in your service task:

${quoVadisDomainListUpdateParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to check if a relation between two core objects exists. The names of both data pools have to be provided. The direction of the relation is not relevant, meaning that source and destination may be exchanged.

Configuration

To use this task, configure the following delegate expression in your service task:

${checkObjectRelationParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to create a relation between two core objects.

Object Relations tab

In this tab you manage the object relation types. A default entry is already set per tenant. Exactly one configuration must be the default configuration which is used when saving data, see Set up process in Identity Manager, the Save Data task.

Include these two fields in an object relations configuration:

• Name: name of the object relation type
• Default: determines if this configuration should be the default configuration

Configuration

To use this task, configure the following delegate expression in your service task:

${createRelationParametrizedJavaDelegate}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to remove existing relations between objects. The removal applies for all relations between one specific object and either:

• a single second object, or
• all other objects belonging to the named Data Pool
• all other objects belonging to the named template.

Furthermore, it is independently possible to restrict the removal to relations of a specific type.

Example: An employee started working with a replacement card. Later he or she receives an employee card. The connection to the reusable replacement card can then be removed.

Configuration

To use this task, configure the following delegate expression in your service task: 

${dropRelationsParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to find core objects (for example, soft tokens), that will expire within a given time range.

Configuration

To use this task, configure the following delegate expression in your service task:

${coreObjectExpiryCheckParameterizedTask}

 The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to generate a response using the card manager key and a challenge for the offline unblocking process.

Configuration

To use this task, configure the following delegate expression in your service task:

${challengeResponseGeneratorTask}

 The following parameter can be configured in Identity Manager Admin:

The following dependencies must be configured in the Spring configuration:

Description 

Use this task to generate a 2DES / 3DES key as card manager key for minidriver compatible cards. The value generated is saved in an encrypted field.

Configuration

To use this task, configure the following delegate expression in your service task:

${cardManagerKeyProviderTask}

 The following parameters can be configured in Identity Manager Admin:

The following dependencies must be configured in the Spring configuration:

Description

Use this task to generate a value for PIN and PUK according to certain rules (length, allowed characters) and to archive those values for later retrieval during card production or for PIN letter printing.

Configuration

To use this task, configure the following delegate expression in your service task:

${generateAndArchivePinAndPukParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to generate a password or another secret and to archive the value for later retrieval during card production or for PIN letter printing. The secret value is also hashed and stored in a separate field for easier comparison. The hash algorithm is defined in Spring since it must be the same as the one that is used for checking the passwords during login.

Configuration

To use this task, configure the following delegate expression in your service task:

${generateAndArchivePasswordWithMaxLengthAndAllowedCharactersTask}

The following parameters can be configured in Identity Manager Admin:

The following dependencies must be configured in Spring:

Description

Use this task to provision a user to Smart ID Digital Access component The task consists of two phases:

• In the first phase the user will be created or updated. This will always be done.
  

  If you do not set a validFrom field, the user always gets the current date as a valid from value in Digital Access.

• The second phase is about locking or unlocking the user:

1. 1. If the current state of the CoreObject matches a state in the lockedStates configuration, the user will be locked.

      • If Smart ID Mobile App (Personal Mobile)is configured, all Smart ID Mobile App profiles that the user has will be deleted.
        

        Deletion of authentication methods SYNC and OATH are not implemented yet.

        
        

   2. If the current state of the CoreObject matches a state in the unlockedStates configuration, the user will be unlocked.
      
      • If Smart ID Mobile App is configured, the binary array of the barcode image (jpg) will be available in "personalimage". If unlocking of the user failed, the processmap will not contain the barcode.
        
      • If OATH is configured, the binary array of the barcode image (jpg) will be available in "oathActivationBarcode". If unlocking the user failed, the processmap will not contain the barcode.
      • If SYNC is configured, SYNC will be activated on Digital Access.

Configuration

To use this task, configure the following delegate expression in your service task:

${provisionUserToHagParameterizedTask}

The following parameters can be configured in PRIME Designer:

Description

Use this task to finalize a process that is going to be used as a post-login process.

Execute the service task at the end of a post-login process in order to mark the post-login process as successfully finished. It will not work without this. Do not use this task outside a post-login process.

Calling this task more than once within a post-login process will result in a failure.

Configuration

There are no parameters to configure.

Description

Use this task to search for a core object and create an AuthenticatedUser which is passed to the datamap with the key "AuthenticatedUser".

Configuration

To use this task, configure the following delegate expression in your service task:

${findAndAuthenticateCoreObjectParameterizedDelegate}

The following parameters can be configured in Identity Manager Admin:

The task can be defined as follows:

    <bean name="findAndAuthenticateCoreObjectParameterizedAction" class="de.vps.act.action.login.FindAndAuthenticateCoreObjectParameterizedAction">
        <property name="coreObjectSearchManager" ref="coreObjectSearchManager"/>
        <property name="authenticationProvider" ref="userPasswordCoreObjectAuthenticationProvider" />
        <property name="authProfileProvider" ref="authProfileProvider" />
        <property name="dataPoolProvider" ref="dataPoolProvider" />
        <property name="coreTemplateProvider" ref="coreTemplateProvider" />
    </bean>

    <bean id="findAndAuthenticateCoreObjectParameterizedDelegate" class="de.vps.act.processexecution.delegation.TaskParametrizedActionBasedJavaDelegate">
        <property name="taskParameterExtractor" ref="taskParameterExtractor" />
        <property name="action" ref="findAndAuthenticateCoreObjectParameterizedAction" />
    </bean>

Description

Use this task to assign an entitlement to a person.

The task works on three different core objects:

• The 'Person'. This is the identity which gets an entitlement assigned.
• The 'Entitlement'. This is an entity in Identity Manager which represents an entitlement (or 'access profile') at the PACS system.
• The 'Assignment'. This is an entity that stores properties of the assignment request and attributes returned from the PACS system (like the external id). Usually an 'Assignment' will be stored as Request.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsAssignEntitlementParametrizedTask}

The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to create a group membership in Smart ID Physical Access component. Group membership means, assigning an existing person to an existing group.

The task works on three different core objects:

• The 'Person'. This is the identity which gets a group assigned.
• The 'Group'. This is an entity in Identity Manager which represents an group at the PACS system.
• The 'Membership'. This is an entity that stores properties of the membership request and attributes returned from the PACS system (like the external id).

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsCreateGroupMembershipParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to send a request to PACS to create (if non existent) or to update (if exists) a card.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsCreateOrUpdateCardParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this action to send a request to PACS to create (if non existent) or to update (if exists) a person.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsCreateOrUpdatePersonParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this action to fetch entitlements of a given type or several types from a PACS system. Currently supported: Physical Access component. The fetched entitlements are stored as core objects.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsFetchEntitlementsParametrizedTask}

 The following parameters can be configured in Identity Manager Admin:

Description

Use this task to send a request to PACS to create (if non existent), update (if exists) and delete (if exists) a group.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsDealWithGroupParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to send a request to PACS to create (if non existent), update (if exists) and delete (if exists) an access rule.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsDealWithAccessRuleParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to withdraw an entitlement from a person.

• For Physical Access component there has to be a Request with the entitlement assignment id in the process map.

The task works only on the core object 'Assignment'. This is an entity that stores the external id of the EntitlementAssignment within Physical Access component. Usually a Request is used to hold this information.

Configuration

To use this task, configure the following delegate expression in your service task:

${pacsWithdrawEntitlementParametrizedTask}

The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to withdraw a group membership in Physical Access component.

Configuration

To use this task, configure the following delegate expression in your service task. There has to be a Request with the group membership id in the process map.

${pacsWithdrawGroupMembershipParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to run a search configuration and trigger an ErrorBoundaryEvent with error code "uniquenessTestFailed" if a uniqueness criteria is not met. The event might cause a different process flow.

Configuration

To use this task, configure the following delegate expression in your service task:

${assertUniquenessParameterizedTask}

 The following parameters can be configured in Identity Manager Admin:

EQUALS:${Person_PersonnelNumber}
GREATER_THAN:${now}
CONTAINS:st

Description

Use this task to load pack binary data objects into a ZIP file. A CoreObjectDescriptor is needed (loaded in a service task before) to have a list with core objects which contain the binary data fields. Different binaries belonging to one core object can be packed together into one ZIP file (for example photo and signature). Reference-fields can also be added into zip, if they represent a binaryData (like softtoken).

Configuration

To use this task, configure the following delegate expression in your service task:

 ${buildZipFileFromBinariesParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Parameter	Mandatory	Value	Description
resultVariableNameZipFile			Fieldname in the datamap where the builded zipFile is written to.
resultVariableNameZipName	-		Fieldname in the datamap where the name of the zipFile is written to.
zipfileName		Example value: ${Person_LastName}_${Person_FirstName}_Binaries.zip	How the zipFile shall be named. fileExtension like '.zip' is needed.
coreObjectDescriptorList			coreObjectDescriptor which contains a list of CoreObjects with binaryData
<name of the zipFile-Entry>	(minimum 1)	<name of binaryField to save into zipFIle> Example value: ${Person_LastName}_${Person_FirstName}_Photo.jpg ← Person_Photo ${Person_LastName}_${Person_FirstName}_Softtoken.p12 ← Person_Softtoken	Additional parameter, added with "+" Combination zipEntryName ← BinaryFieldName

Description

Use this task to copy information about the currently logged in user to the process data map. Since the parameters are optional, only those parameters where a value is provided are copied to the process data map.

Configuration

To use this task, configure the following delegate expression in your service task:

${copyValuesOfLoggedInUserToProcessMapParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

${userinfoUserRoles.contains("Administrator") == true}

Description

Use this task to delete a secret field from secret field store and clear the reference to it.

Configuration

To use this task, configure the following delegate expression in your service task:

${deleteSecretField}

 The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to execute a script and put the result variables to the process map.

Configuration

To use this task, configure the following delegate expression in your service task: 

${executeScriptTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to run a search configuration and put the result to the map as core object descriptor list or as the complete object.

If the number of search results is equal to or more than maxCount this is logged in the Tomcat log file.

A process variable executeSearchResultCount will hold the number of the found entities.

Configuration

To use this task, configure the following delegate expression in your service task:

${executeSearchParameterizedTask}

 The following parameters can be configured in Identity Manager Admin:

Description

Use this task to find the next possible/valid states to a given core object state. If the multiple selected core objects (in a batch order) do have different states (for example active, inactive), an ErrorBoundaryEvent will be triggered.

 Configuration

To use this task, configure the following delegate expression in your service task:

${findNextPossibleStates}

The following parameters can be configured in Identity Manager Admin:

The task can be defined as follows:

<bean id="findNextPossibleStatesAction" class="de.vps.act.processexecution.state.FindNextPossibleStatesAction">
   <property name="coreTemplateProvider" ref="coreTemplateProvider"/>
   <property name="stateGraphDefinitionManager" ref="stateGraphDefinitionManager"/>
   <property name="coreObjectDAO" ref="coreObjectDAO"/>
</bean>

<bean id="findNextPossibleStates" parent="parameterizedTask">
   <property name="action" ref="findNextPossibleStatesAction" />
</bean>

Description

Use this task to load an entity into the process map.

Given a datapool, a field, the field's value and optionally a core template, the matching entity will be loaded. If more than one entity matches, no entities will be added to the process map. A process variable loadEntityResultCount will hold the number of the found entities. Any value other than 1 can be considered an error.

Configuration

To use this task, configure the following delegate expression in your service task:

${loadEntityParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description 

This task expects a certificate in the process map and loads an entity from the DB, based on a value of the certificate. You configure what kind of entity (Person, Server etc) and which certificate field should match which field of the entity. A case insensitive search is performed. If exactly one entity is found, it will be added to the process map. If more that one entity is found, no entities will be added to the process map. A process variable loadCertificateMatchingEntityResultCount will hold the number of the found entities. Any value other than 1 can be considered an error.

This task can be used to establish an objectRelation between the certificate and an entity.

Configuration

To use this task, configure the following delegate expression in your service task:

${loadCertificateMatchingEntityParameterizedTask}

 The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to load one or more values of SystemProperties, which are configured in the Admin tab in Identity Manager, into fields of the process map.

Configuration

To use this task, configure the following delegate expression in your service task:

${loadSystemPropertyIntoProcessmapParametrizedTask}

 The following parameters can be configured in Identity Manager Admin, they can be added with the '+'-button, each row sets one system property into the target field:

Description

Use this task to log something in the logfile. The results will not be visible to an end user.

Configuration

To use this task, configure the following delegate expression in your service task:

${loggingParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to remove an entity from the process map. Given a name of a datapool, all fields from the datamap will be removed. If the given name does not match a datapool, no fields will be removed.

Configuration

To use this task, configure the following delegate expression in your service task:

${removeEntityFromDatamapParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to remove a variable from the data map of the process.

Configuration

To use this task, configure the following delegate expression in your service task:

${variableRemovingParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to compare two secret fields. If they are equal, the service task will return true, otherwise, false. The comparator is case sensitive, so only exact matches will return true. Note that blank values are not considered valid.

Passing secret fields directly into the data map is a security issue, so the service task will only expect UIDs of valid, already stored, secret fields.

Configuration

To use this task, configure the following delegate expression in your service task:

${compareSecretsParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to set a variable to a desired value, including an empty string or null.

Configuration

To use this task, configure the following delegate expression in your service task:

${setValueOfVariableInProcessMapParameterizedTask}

The following parameters can be configured in PRIME Designer:

Be sure to configure exactly only one of variableValue, setToNull and setToEmptyString. Otherwise an Exception is thrown.

JUEL expressions

Unresolvable JUEL expressions in variableValue are ignored by default.

If you want an exception to be thrown instead, add the following bean definitions to your custom-beans.xml:

 <bean id="keyNotFoundThrowingSpelResolver" class="de.vps.act.juel.SpelExpressionResolver">
        <constructor-arg name="expressionPrefix" value="${" />
        <constructor-arg name="expressionSuffix" value="}" />
        <constructor-arg name="keyNotFoundSafe" value="false" />
    </bean>

    <bean id="setValueOfVariableInProcessMapParameterizedAction"
          class="de.vps.act.action.datamap.modification.SetValueOfVariableInProcessMapParameterizedAction">
        <property name="juelExpressionResolver" ref="keyNotFoundThrowingSpelResolver" />
    </bean>

Description

Use this task to execute a searchConfig and search in a list of X509-certificates for the newest Encryption Certificate.

If one is found it is saved in the database (if it`s not existing already under the configured core template name) and loaded into the processMap as CoreObjectDescriptor.
If the certificate is found in the database but under a different core template name, a second entry will be saved under the configured core template name.

This task is useful, for example, when a field of a LDAP-datapool contains a (multi-value binary) list of certificates.

Configuration

To use this task, configure the following delegate expression in your service task:

${searchNewestEncCertParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to validate a value in the process data map against a regular expression. The result is saved as true/false in the process data map.

Configuration

To use this task, configure the following delegate expression in your service task:

${validateFieldWithRegexParameterizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to provision a new profile or update an existing one, overwriting existing keys. The task will create the keys needed for the "Mobile App: Install certificates" task.

The task will generate the following PKCS#10 request templates:

• Signature Certificate (optional)
• Authentication Certificate (optional)
• Device Encryption (used to secure the communication with Smart ID Mobile App)

These requests will then be sent to the mobile phone and transformed into new PKCS#10 requests (with keypairs generated on the client but keeping all subject data). The new requests userid will then be sent to the message catching intermediate event identified by the parameter 'messageName'. Identity Manager will put these PKCS#10 requests into the process map under the keys "SIG_P10_VAR", "AUTH_P10_VAR" and "DEVICE_ENC_P10_VAR". If a new profile was created, Identity Manager will also put the new profileId into the process map under the key "profileId". In order to save the profile id you will need to copy it into a data pool field.

After this task is executed, you need to request certificates using the requests stored in the process variables "SIG_P10_VAR" and "AUTH_P10_VAR" before proceeding to the "Mobile App: Install certificates" task. Store the requested certificates into the process map.

Configuration

To use this task, configure the following delegate expression in your service task:

${hermodKeyCreationTask}

The following parameters can be configured in Identity Manager Admin:

Description 

Use this task to request and install certificates that were prepared using the "Mobile App: Create Key" task.

As a prerequisite

• you must already have requested certificates with the authentication and signature certification requests generated by the "Mobile App: Create Key" task and stored them as process variables.
• if you want to perform certificate recovery, you must prepare the data for that using 'Cert: Load Key History List'.

Use this task to install a number of certificates on the mobile phone:

• Signature Certificate, will be bound to the key pair created by "Mobile App: Create Key".
• Authentication Certificate, will be bound to the key pair created by "Mobile App: Create Key".
• Device Encryption Certificate, will be bound to the key pair created by "Mobile App: Create Key".
• Encryption Certificate created with key archival.
• Any number of recovered certificates.

Configuration

To use this task, configure the following delegate expression in your service task:

${hermodInstallCertificatesTask}

The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to delete a profile managed by Smart ID Desktop App. It can also delete all Smart ID Messaging mailboxes for a specific user id.

This task can be used in the following ways:

Delete profile on Smart ID Mobile App and Smart ID Messaging

Executed the task on a card profile which contains information about the profile id.

1. Specify a profile id and set the confirmation flag to true. All other parameters must be provided as well.
2. The request will be sent to Smart ID Mobile App, which will delete the profile identified by the specified profile id.
   • The result will be sent to the message catching intermediate event identified by the parameter 'messageName'.
   • After receiving a successful response from Smart ID Mobile App, Smart ID Messaging also deletes the mailbox and forwards the same response back to Identity Manager.

Delete mailbox on Smart ID Messaging only

1. Set the confirmation flag to false.

   Even if the confirmation flag is set to false, you need to set the 'messageName' parameter to a dummy value to be able to delete the mailbox(es).

2. Smart ID Messaging will delete either a specific mailbox when a profile id is provided or all mailboxes of the specified user id when the profile id is absent.
   The profiles themselves in their respective apps will be retained, as the deletion request will not be forwarded.

Configuration

To use this task, configure the following delegate expression in your service task:

${pmHermodDeleteProfileTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to create up to three template PKCS#10 requests that can be used to request certificates needed for the "Desktop App: Install Certificates on Virtual Smart Card" task.

Use this task to create up to three template PKCS#10 requests:

• Signature Certificate (if template name is provided)
• Authentication Certificate (if template name is provided)
• Device Encryption (always, used to secure the communication with Smart ID Desktop App)

These requests will then be sent to Smart ID Desktop App and transformed into new PKCS#10 requests (with keypairs generated on the client but keeping all subject data). The new requests will then be sent to the message catching intermediate event identified by the parameter 'messageName'. Identity Manager will put these PKCS#10 requests into the process map under the keys "SIG_P10_VAR" and "AUTH_P10_VAR". Identity Manager will also put the new profile id into the process map under the key "profileId". In order to save the profile id you will need to copy it into a data pool field.

This task can only provision a new profile - updating an existing profile is currently only supported in Smart ID Mobile App at this time, not in Smart ID Desktop App.

Configuration

To use this task, configure the following delegate expression in your service task:

${pxVscHermodKeyCreationTask}

The following parameters can be configured in Identity Manager Admin: 

Description

This task requests and installs certificates that were prepared using the "Desktop App: Create Virtual Smart Card Key" task.

As a prerequisite

• you must already have requested certificates with the authentication and signature certification requests generated by the "Desktop App: Create Virtual Smart Card Key" task. Store the certificates as process variables.
• if you want to perform certificate recovery, you must prepare the data for that using 'Cert: Load Key History List'.

Use this task to install a number of certificates on a profile maintained by the Smart ID Desktop App:

• Signature Certificate, will be bound to the key pair created by 'Desktop App: Create Virtual Smart Card Key'.
• Authentication Certificate, will be bound to the key pair created by 'Desktop App: Create Virtual Smart Card Key'.
• Device Encryption Certificate, will be bound to the key pair created by 'Desktop App: Create Virtual Smart Card Key'.
• Encryption Certificate created with key archival.
• Any number of recovered certificates.

Configuration

To use this task, configure the following delegate expression in your service task:

${pxVscHermodInstallCertificatesTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to delete a virtual smart card profile managed by Smart ID Desktop App on a TPM and also to delete all Smart ID Messaging mailboxes for a specific user id.

This task can be used in the following ways:

Delete Virtual Smart card profile on Smart ID Desktop App and Smart ID Messaging

Execute this task on a smart card profile which contains information about smart card id, profile id and card manager key (admin key).

1. Specify a profile id and set the confirmation flag to true. All other parameters must be provided as well.
2. The request will be sent to Smart ID Desktop App, which will delete the profile identified by the specified profile id and smart card id. Smart ID Desktop App will also change the card's admin key to the new value provided.
   • The result will be sent to the message catching intermediate event identified by the parameter 'messageName'.
   • After receiving a successful response from Smart ID Desktop App, Smart ID Messaging also deletes the mailbox and forwards the same response back to Identity Manager.

Delete mailbox on Smart ID Messaging only

1. Set the confirmation flag to false. Smart card id and keys can be omitted.
2. Smart ID Messaging will delete either a specific mailbox when a profile id is provided or all mailboxes of the specified user id when the profile id is absent.
   • The profiles themselves, in their respective apps, will be retained, as the deletion request will not be forwarded.

Configuration

To use this task, configure the following delegate expression in your service task:

${pxVscHermodDeleteProfileTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to create a template PKCS#10 request that can be used to request the certificate needed for the "Desktop App: Install Certificates On Windows Cert Store" task:

• Device Encryption (used to secure the communication with Smart ID Desktop App)

Identity Manager will also put the new profileId into the process map under the key "profileId". In order to save the profile id you will need to copy it into a data pool field.

This task can only provision a new profile - updating an existing profile is currently only supported in Smart ID Mobile App at this time, not in Smart ID Desktop App.

Configuration

To use this task, configure the following delegate expression in your service task:

${pxOsHermodKeyCreationTask}

The following parameters can be configured in Identity Manager Admin: 

Description

Use this task to request and install certificates that were prepared using the "Desktop App: Create Windows Cert Store Key" task.

As a prerequisite

• you must already have requested certificates with the authentication and signature certification requests generated by the "Desktop App: Create Virtual Smart Card Key" task. Store the certificates as process variables.
• if you want to perform certificate recovery, you must prepare the data for that using 'Cert: Load Key History List'.

Use this task to install a number of certificates on the Windows Certificate store:

• Device Encryption Certificate, will be bound to the key pair created by 'Desktop App: Create Windows Cert Store Key' task.
• Softtoken certificate created with key archival.
• Any number of recovered certificates.

Configuration

To use this task, configure the following delegate expression in your service task:

${pxOsHermodInstallCertificatesTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this task to start a connection to Smart ID Messaging. With this connection, scripts can be executed. Finally, the connection needs to be closed.

Once the connection is established you receive a boxId and a plugoutUrl which can be used to start Smart ID Desktop App and connect it to the corresponding box on Smart ID Messaging.

Configuration

To use this task, configure the following delegate expression in your service task:

${hermodStartConnectionParametrizedTask}

The following parameters can be configured in Identity Manager Admin:

Description

Use this service task to execute a script in Smart ID Desktop App. The script needs to be passed as a JSON array (for example: [{"type":"APDU", "data":"00A4040000", "response":".*(9000)"}]) 

Configuration

To use this task, configure the following delegate expression in your service task:

${hermodExecuteScriptParametrizedTask}

The following parameters can be configured in Identity Manager Admin: