Nexus Documentation
Nexus Documentation
Breadcrumbs

Set up integration with Honeywell EBI

This article is new for Smart ID 26.07.1.

This article describes how to configure the Honeywell EBI Service, to enable integration between Smart ID Identity Manager Honeywell EBI via a CMS DLLs using windows credentials.

EBI is an Access Control System provided by Honeywell and managed via a CMS DLLs. After integration, all administration of Users, Access Token and Entitlements (besides defining them) should be done in Identity Manager, never in Honeywell EBI.

For details on which data can be imported and exported from Honeywell EBI, see About import and export to Physical Access.

Prerequisites

The following prerequisites apply:

  • Physical Access and the Honeywell EBI Docker container/service are installed. See Deploy Smart ID.

  • Honeywell EBI R610 server version 922.5.277.0 or newer is required. The CMS API (DLL) version 922.1.241.0 is required to interact with Honeywell EBI.

  • The message queue server must be running

  • If MIFARE card technology is used, the PACS MIFARE number must be available as raw data (not encrypted, truncated, or similar). 

  • A working network connection to the connected physical access control systems (PACS) must be in place.

Install IIS web server and Host Ebi Bridge Service

To host the Ebi Bridge Rest API Service on the Honeywell EBI Server, an IIS server must be installed.

  1. If an IIS server is not installed, then follow Step 1 in https://docs.microsoft.com/en-us/iis/manage/creating-websites/scenario-build-a-static-website-on-iis to install it.

  2. To Host Ebi Bridge Rest API Service, we need support for .Net Framework 4.7.2, Please check if it is enabled or we can enable it using ‘Turn Windows features on or off’ program.

  3. Host the Ebi Bridge Rest API Service, according to Step 2 in the above article.

  4. We are using windows credentials to authenticate CMS API so in Application pool of Ebi Bridge Rest API Service we need to configure windows credentials using Identity as custom account and enter username and password of windows login. (IIS-> Application pool->EBIBridgeService->Advanced Settings->Identity->Custom Account)

  5. Verify that the web service is hosted correctly, by browsing to the URL:
    Example: Honeywell EBI Rest API Service URL http://localhost:<port>>/api/cms/health

  6. Configure the following parameters in the web service configuration file \ EbiBridgeService\Web.Config:

key

Data type

Required or Optional

Description

apiUrl

string

Required

The ApiKey is a unique alphanumeric code used to authenticate an Ebi Bridge Rest API Service, we need to configure same ApiKey in EbiService using Physical Access Admin portal.

Configure EBI Service data fields

The EBI connector data is configured in the configuration table in the Physical Access database. All configuration is cached when the service starts so any configuration changes will require the service to be restarted in order to take effect.

Handling sensitive configurations

To secure sensitive data like passwords, connections strings, API endpoints etc., AES 256 encryption is added for each configuration while stored in the database. The data is not displayed in the UI.

Any configuration can be marked as sensitive data field using a backend database update.

Configure database

For information about how to connect to a PACS system, see Connect to a PACS system in PACS admin panel.

For information about group: messagingqueue, see Physical Access database - common parameters.

group: ebi.system

key

Data type

Required or Optional

Description

apiUrl

string

Required

It is the URL for hosted Ebi Bridge Rest API Service which will be used to communicate with Honeywell EBI server using CMS DLLs.

Default: https://ebiserver/

apiKey

string

Required

The ApiKey is a unique alphanumeric code used to authenticate an Ebi Bridge Rest API Service, need to use same API key which is configured in Ebi Bridge Rest API Service’s web.config.

Default: YOGNEXINGRP

group: ebi.general

key

Data type

Required or Optional

Description

server

string

Required

Server name of Honeywell EBI system..

Default: syuldhebia

group: ebi.export

key

Data type

Required or Optional

Description

updatesPerPoll

int

Optional

The number of persons to export per poll.

Default: 100

organization

string

Required

Default organization of Honeywell EBI system

Default: default

layoutIdentifierType 

string

Required

This is a type of identifier which we want to use to refer layout of access token.

Default: Layout

group: export

key

Data type

Required or Optional

Description

userfieldmappings

string

Optional

userfieldmappings is used to export additional data of users to Honeywell EBI. The value in is a combination of table_name.value_of_type_column, field_id_of_EBI. This configuration setting is the mapping between the Physical Access table field and Honeywell user fields

User column fields can be sent by adding the configuration user.column_name, ebi_field_id.

The following table shows sample configurations for userfieldmappings:

system

key

value

group

index

EBI

userfieldmappings

user.ssn,Identifiant

export

0

EBI

userfieldmappings

useradditionalfield.Company,Companie1

export

1

EBI

userfieldmappings

email.work,EBI_Field1

export

2

EBI

userfieldmappings

address.work,EBI_Field2

export

3

EBI

userfieldmappings

phone.mobile,EBI_Field3

export

4

EBI

userfieldmappings

useradditionalfield.Field4,EBI_Field4

export

5

group: ebi.card.mapping.default

This group defines how to export card numbers by default, when a card’s layout does not have a specific mapping.

key

Data type

Required or Optional

Description

layout

string

Optional

The name of the card layout to match (case insensitive) for this mapping. Each layout may only be mapped once.

cardNumberIdentifier

string

Optional

This indicates the identifier for card number.

format

string

Optional

The format that the card number should be converted into before exporting it to EBI.

Valid values: Linear, LinearReverse, Block, BlockReverse.

length

int

Optional

The length that the card number should be trimmed (leading digits) or padded (with leading zeroes) to after converting it.

cardType

string

Optional

Card Type for EBI card.

Possible values:Standard, Generic

credentialType

int

Optional

Credential Type for EBI card. Possible values are 0 to 7, mentioned detailed mappings in CredentialType Section

group: ebi.card.mapping.{value of layout identifier}

This group contains compound configuration elements using the config_index column. For each unique config_index value in this group, each key defined below must be defined exactly once. Note that this group is not required as a whole, and should only be used if you have specific requirements for one or more card layouts.

key

Data type

Required or Optional

Description

layout

string

Optional

The name of the card layout to match (case insensitive) for this mapping. Each layout may only be mapped once.

cardNumberIdentifier

string

Optional

This indicates the identifier for card number.

format

string

Optional

The format that the card number should be converted into before exporting it to EBI.

Valid values: Linear, LinearReverse, Block, BlockReverse.

length

int

Optional

The length that the card number should be trimmed (leading digits) or padded (with leading zeroes) to after converting it.

cardType

string

Optional

Card Type for EBI card.

Possible values:Standard, Generic

credentialType

int

Optional

Credential Type for EBI card. Possible values are 0 to 7, mentioned detailed mappings in CredentialType Section

The following table shows sample configurations for card mapping settings:

system

key

value

group

index

EBI

layout

Default

ebi.card.mapping

1

EBI

cardNumberIdentifier

proxy

ebi.card.mapping

1

EBI

length

9

ebi.card.mapping

1

EBI

format

Linear

ebi.card.mapping

1

EBI

cardType

Standard

ebi.card.mapping

1

EBI

credentialType

1

ebi.card.mapping

1

Credential Type mapping

This property is only visible if you use more than one credential type. If you do, select the appropriate credential type. (Cards of a specific credential type, for example, cards with magnetic stripes, can only be used with readers with the same credential type.).

EBI Id

EBI Display Name

0

Default

1

HID 35 Bit

2

ADM HID 35 Bit

3

HID 37 Bits

4

ADM Office HID 36 Bit

5

34 Bit Bioscript ADM

6

ADM HID 48 Bit

7

Liftmaster 26-bit MIRA

SmartID-Honeywell EBI data mappings

SmartID Physical Access imports entitlements (Access Rights) and export employee(user) with active access token(card) and entitlement assignment (Access Rights) to Honeywell EBI via a CMS DLLs. Below are object/data mappings used in integration

EBI Access Rights – SmartID PA Entitlement

Honeywell EBI field

data type

SmartID PA field

data type

Name

string

DisplayName

string

ID

int

ExternalId

string

EBI Cardholder – SmartID PA User

During Cardholder export, system will always check cardholder exists based on ExternalKey and perform add or update accordingly. System will delete cardholder if user don’t have at least one active access token or entitlement assignment. System will always delete not active user record.

Honeywell EBI field

data type

SmartID PA field

data type

FirstName

string

GivenName

string

LastName

string

FamilyName

string

DateofBirth

Date

Default Value 1/1/1980

Date

ExpiryDate

Date

ValidTo if empty then default date after 50 years

Date

CardholderState

int

Status mapped using Active (0), Deleted (1), Inactive (3), Expired (4)

string

ExternalKey

string

Ssn

string

Identifiant

ExternalKey

ID by default but we can change mapping using userfieldmappings configurations mentioned above.

ExternalKey

Companie1- Companie10

string

Default ‘-’, configurable using userfieldmappings configurations mentioned above.
Ex. useradditionalfield.Company,Companie1

string

EBI Card – SmartID PA Access Token

During Cardholder card assignments its always check existing card and if exists then skip exporting that card on user. System will remove user card if it is not active.

Honeywell EBI field

data type

SmartID PA field

data type

CardNumber

string

Access token Identifier value with matching configuration for Identifier type

string

CredentialType

string

Matching configuration’s CredentialType

string

CardType

string

Matching configuration’s CardType

string

PINCode

string

User’s Pin

string

Expirytime

Date

Cards ValidTo if empty then default date after 50 years

Date

CardState

int

Status mapped using Active (0), Deleted (1), Inactive (3), Expired (4)

string

EBI User Access Rights – SmartID PA Entitlement Assignment

During Cardholder access rights assignments its always delete existing assignments and add newly added, PA will always keep all active assignments.

Honeywell EBI field

data type

SmartID PA field

data type

Name

string

DisplayName

string

ID

int

ExternalId

string

Restart service

Restart the Honeywell EBI connector service:

Restart Physical Access Honeywell EBI connector 
cd <SMARTIDHOME>/compose/physicalaccess
docker-compose restart smartid-pa-ebi

Last updated: