Managed Access Gateway. User Guide

Transcription

1 Managed Access Gateway User Guide Version 2.2 Exostar, LLC November 3, 2011

2 Table of Contents Table of Contents... ii Purpose... 1 Log-in to your MAG Account... 2 Additional MAG Login Options... 2 First Time Login... 3 Your Account... 3 Enterprise Access Gateway (EAG) Information... 6 Forgotten User ID & Password... 6 Forgotten UserID for an Active Account... 7 Forgotten Password for an Active Account... 8 Expired Password for an Active Account... 9 Forgotten Security Questions/Answers Application Management Application Status Information: Request Access Requesting access to all applications other than FIS Requesting access to FIS In-Person Proofing Pending Acceptance of Terms & Conditions View and Modify Account Edit Profile Update Enterprise Access Gateway (EAG) Account Settings Link Accounts Lost EAG Cookie: Re-link accounts Password reset and other user actions for EAG users View Organization Details Change Change Password Change Security Questions Manage OTP Manage Certificates Download Certificates Basic Level of Assurance (Identity) Download Certificates Basic Level of Assurance (Secure ) Download Certificates Medium Level of Assurance (Software) Download Certificates Medium Level of Assurance (Hardware) Pre-requisites Hardware Token FIPS Mode Review Hardware Token FIPS Mode Initialization Downloading certificates to your token: View Certificates (MAG) View Certificates (etoken for MLOA Hardware) Revoke Certificates Recover Encryption Keys Importing Recovered Encryption Keys Renew Certificates Reapply for Certificates Account Disablement Frequently Asked Questions (FAQs) ii

3 Note: There may be some minor differences in the screenshots presented in this guide. We attempt to update all screenshots as changes happen to our product. iii

4 Purpose This guide has been created for all users of Managed Access Gateway (MAG). This guide will provide you information on the tasks that you need to perform to manage your user account. You can access MAG by logging on to: When you login to with your credentials, the system automatically identifies your designation and presents your view of the dashboard. For most users, the following view is available: This guide will provide you information on your Exostar MAG account and functionality. It is intended for users wishing to learn more about MAG or to answer specific questions regarding your experience within the system. This guide provides information on the following: Login Information First Time Login Your account Forgotten UserID & Password Forgotten User ID Forgotten Password Expired Password Application Management View and Modify Account Edit Profile View Organization Information Change address Change Password Change Security Questions Manage Certificates (For users with FIS subscription) Download Certificates View Certificates Revoke Certificates Recover Encryption Keys Import Recovered Encryption Keys Reapply for Certificates Copyright 2009 Exostar LLC. All rights reserved Page 1 of 58

5 Log-in to your MAG Account If you have not yet completed the First Time Login, refer to the First Time Login Guide. 1. Go to The following screen will be presented. See a different login screen? MAG User Guide 2. Enter your User ID and password and click Login button. 3. You will be presented MAG applications page. Additional MAG Login Options MAG allows you to login to your account using digital certificates or via federation for additional security. You may be able to use one of the following additional options to login: Exostar s FIS certificates: Allow you to select FIS certificates in addition to your UserID and Password to enable you to access all your applications without being prompted to select the certificates when you access an application. DOD Common Access Card (CAC): Allows you to login to MAG without UserID and Password. For more information, refer to the DOD CAC guide. NGC OneBadge: Allows you to use your NGC OneBadge to login to MAG without UserID and Password. You may get additional information from your xxxxxxxxxxxxxxxxxxxxx. Enterprise Access Gateway (EAG): Allows you to login to MAG without UserID and Password. Refer to EAG section for additional details. One-Time Password Hardware Token: In addition to UserID and Password, you will be required to enter the One- Time Password generated via a hardware token purchased from Exostar. Refer to the OTP Hardware Token User Guide for additional details. Copyright 2009 Exostar LLC. All rights reserved Page 2 of 58

6 First Time Login Refer to the First Time Login Guide or for detailed information on activating your account. Your Account When you login to Exostar, you will be presented the Account Management Home page. This may include two or more of the following 4 tabs depending upon your role: Home: This tab has a number of components to allow you to have a dashboard view of your MAG account with information on your roles and responsibilities. Here is a brief introduction to the components of the page: o My Applications: The applications listed on the applications section are based on your subscriptions. Applications are grouped based on the Service Provider for easy view. The status of each application and available actions are provided next to the application name. If there are any special announcements for the application, the announcements column provides the information. Copyright 2009 Exostar LLC. All rights reserved Page 3 of 58

7 o My Organization: You will be able to view this section by clicking on the +Expand all sections button to expand all sections or just by clicking on the expander icon for the section. Depending upon your role(s), this section provides you information regarding your organization account along with the available subscriptions. The view presented below is for a user with the Organization Administrator role. o My Tasks: You will be able to view this section by clicking on the +Expand all sections button to expand all sections or just by clicking on the expander icon for the section. Depending upon your role(s), you may view all requests pending approval by you in this section. If no pending tasks are available, you will be shown the message as provided in the screenshot below. o Account Summary: You will be able to view this section by clicking on the +Expand all sections button to expand all sections or just by clicking on the expander icon for the section. This section will provide you information on your account and role(s) for the organization s MAG account. Copyright 2009 Exostar LLC. All rights reserved Page 4 of 58

8 o Quick Links: You will be able to view this section by clicking on the +Expand all sections button to expand all sections or just by clicking on the expander icon for the section. This section provides links to various training demos and additional support links for quick reference. My Account: This tab provides you information regarding your account. You can also find information on the Organization administrator as well as application administrators for subscribed applications via this tab. You can also make modifications to your account by selecting appropriate action. Administration: Available only to the user with Organization Administrator role. This tab allows you to view the information on all the users that are linked to your organization. This tab is available only if you have administration privileges for your organization s account. Registration Requests: Available to users with Application Administration role. This is the tab where you will need to complete all approvals and authorization tasks. This tab is available only if you have administration privileges for your organization s account. These tabs are available based on the administration privileges assigned to your account. For further information on the administration tasks, refer to MAG Administration Guides. Copyright 2009 Exostar LLC. All rights reserved Page 5 of 58

9 Credential Strength: In addition to the available tabs, you will also be provided information on the credential strength of your login. This information is provided on the right-hand corner of the screen: The following information may be presented depending on how you logged-in: Username & Password: If you logged-in to MAG using only your User ID and password. Basic Software Cert: If you logged-in to MAG using your FIS Basic Level of Assurance (BLOA) certificates MLOA Software: If you logged-in to MAG using FIS Medium Level of Assurance (MLOA) software certificates. MLOA Hardware: If you logged-in to MAG using FIS Medium Level of Assurance (MLOA) Hardware or any eligible third party LOA 3 certificates such as DOD Common Access Card. Enterprise Access Gateway (EAG) Information For users that are using the Enterprise Access Gateway (EAG) functionality, if the network account has been de-linked, you will be able to re-link your account by following the link highlighted below. Forgotten User ID & Password You can change your password for the following three scenarios: Forgotten UserID for an active account Forgotten Password for an active account Password has expired IMPORTANT: These options will not be available if your MAG account has been linked to your corporate network login via Enterprise Access Gateway (EAG). If you have issues accessing your account, refer to EAG user Guide for quick reference or contact Exostar Customer Support for additional information. Copyright 2009 Exostar LLC. All rights reserved Page 6 of 58

10 Forgotten UserID for an Active Account Demo: If you have forgotten your credentials for the First Time Login, refer to the First Time Login Guide. Step 1: Access the MAG login page at: and select the Forgot User ID link Step 2: Enter your address and Zip/Postal code as in your MAG account and click Continue. Step 3: You will receive a confirmation page and an will be sent to your address with a password. You can now login to your MAG account using the new password. If you receive an error stating multiple user IDs were found for this address, contact Exostar Customer Support for further help. Copyright 2009 Exostar LLC. All rights reserved Page 7 of 58

11 Forgotten Password for an Active Account Demo: If you have forgotten your credentials for the First Time Login, refer to the First Time Login Guide. Step 1: Access the MAG login page at: and select the Forgot Password? link Step 2: Enter your User ID and click Continue Step 3: The Answer Security Questions screen is displayed. Enter answers for two (2) questions and click Continue -- Remember that you selected and answered four (4) security questions during your initial account setup. Note that the answers to the security questions are case sensitive. NOTE: If you have forgotten answers to your security questions, refer to Security questions sections for next steps. Step 4: The Create New Password screen is displayed. Enter your new password twice and click Continue. Copyright 2009 Exostar LLC. All rights reserved Page 8 of 58

12 Confirmation: You ll receive a confirmation message that indicates your password has been changed. Expired Password for an Active Account If you have not logged in to MAG in a long time and your password has expired, you will receive the following message: Follow the steps below to reset the password: Step 1: Click on Reset Password button (highlighted above). Step 2: Enter your User ID and click Continue Step 3: The Answer Security Questions screen is displayed. Enter answers for two (2) questions and click Continue -- Remember that you selected and answered four (4) security questions during your initial account setup. Note that the answers to the security questions are case sensitive. Copyright 2009 Exostar LLC. All rights reserved Page 9 of 58

13 NOTE: If you have forgotten answers to your security questions, refer to Security questions sections for next steps. Step 4: The Create New Password screen is displayed. Enter your new password twice and click Continue. Confirmation: You ll receive a confirmation message that indicates your password has been changed. Forgotten Security Questions/Answers 1. Click on the Forgot Security Questions/Answers? link as highlighted above. The following page appears: Copyright 2009 Exostar LLC. All rights reserved Page 10 of 58

14 2. Enter your address associated to this account and the ZIP code or Postal code associated to this account. Click Continue and the following page will appear. 3. You will receive an containing a temporary system-generated password. 4. Return the main MAG login page at: and login using your: 1. UserID 2. The temporary password you just received in the 5. The Create New Password screen is displayed. Enter your new password twice and click Continue. 6. Confirmation: You ll receive a confirmation message that indicates your password has been changed. IMPORTANT: These options will not be available if your MAG account has been linked to your corporate network login via Enterprise Access Gateway (EAG). If you have issues accessing your account, refer to EAG user Guide for quick reference or contact Exostar Customer Support for additional information. Copyright 2009 Exostar LLC. All rights reserved Page 11 of 58

15 Application Management MAG User Guide The MAG Applications page displays all the applications that your organization is subscribed to with information on status of these applications for your account and available actions for you. It also shows any messages/announcements from Exostar or the application owner. Application Status Information: # Status Status Description User Action 1. Active Subscription has been approved to access the application. Click 'Open Application' to launch the application in a separate browser window. 2. Organization Registration The organization s request for subscription to the None. Approval Pending application has not yet been approved. No user can request access to the application. 3. Pending account creation The application has not yet been provisioned by the None. by the Application Service Provider (SP). 4. Pending Approval by the Request is pending approval by the SP Administrator. None. Application Owner 5. Pending Application Administrator Approval The application administrator (App Admin) has not approved the subscription request. Contact the App Admin for the application. How do I find the App Admin? 6. Pending Activation The SCP App Admin has not yet activated your SCP application subscription 7. Pending Acceptance of Terms & Conditions The Organization Administrator (Org Admin) has not yet accepted the Terms & conditions for access to the application. 8. Inactive You are not subscribed to the application, but the organization is subscribed to the application. The Org Admin & EPA can also request application subscription on your behalf. Contact the App Admin for the SCP application. How do I find the App Admin? Contact the Org Admin for information. How do I find the Org Admin? If you need access to the application, click on the Request Access button next to the inactive status. Your request will then be in Pending Application administrator Aproval status. 9. Suspended Your application access has been suspended. None. 10. Pending Exostar Approval Specific to FIS Medium Level of assurance request, your request is pending approval by the Exostar Portal Administrator. Contact Exostar Customer Support for information on delay in approval. 11. Pending Proofing Specific to FIS Medium Level of assurance request, you need to complete in-person proofing process. 12. Pending Application Administrator Approval You have an active FIS subscription, and have reapplied to get new certs. Contact Exostar Customer Support for information if in-person proofing has been completed. None. How do I find the application administrator? Copyright 2009 Exostar LLC. All rights reserved Page 12 of 58

16 Request Access To request access to an application, click on the Request Access link from the Action column for the application as highlighted below: Depending upon the application that you are requesting access, you will be presented with application specific registration upgrade screen(s). Refer to the sections below for application-specific information: Requesting access to all applications other than FIS 1. Click on the Request Access link under the Action column for FIS. NOTE: You will be provided a sponsor code by Exostar/your Organization Administrator or the organization that has invited you for access to the application. This is NOT a required field, so if you do not have this information, click Next>>. 2. Click on Next to complete application access request. You will be presented with a confirmation page. IMPORTANT: if you have questions regarding the sponsor code to use, contact the sponsor, refer to the information on our customer site or Exostar Customer Support for additional information. Copyright 2009 Exostar LLC. All rights reserved Page 13 of 58

17 What happens next? The Application administrator for the application will need to approve your request for access to the application. If the Application administrator approves the request, the Application owner will receive a notification to approve your access to the application. Once the Application owner has approved the access, you will receive a notification that your access to the application has been approved. Requesting access to FIS 1. Click on the Request Access link under the Action column for the FIS application. 2. FIS Certificate Information: In this section, you will prompted for the following information: Sponsor Code: You will be provided a sponsor code by Exostar/your Organization Administrator or the organization that has invited you for access to the application. This is NOT a required field. Copyright 2009 Exostar LLC. All rights reserved Page 14 of 58

18 Partner/Application: Click on this field to display the drop-down list of Partners or applications which may require you to have FIS certificates. This helps the FIS Administrator in approving your request with the appropriate information. You may select Other/Unspecified option if you don t have this information. Certificate Assurance Level: You have the option of selection Basic (for Basic Level of Assurance), Medium (for Medium Level of Assurance) or Unknown. Please note that if you select Unknown, your FIS Administrator may take additional time to approve your request to ensure that s/he approves you for the correct certificate option. Certificate Usage: This option is available only when you select Basic as the Assurance Level. The options available to you are: Identity, Secure and Unknown. IMPORTANT: If you are requesting FIS certificates for accessing ForumPass-US or ForumPass-EU applications, you MUST select Identity as the option for this field. Certificate Type: Depending upon the assurance level selected as well as the FIS subscription level of your organization s account, you may have all or some of the following options: Software, Hardware or Unknown. Certificate Validity Period: If you select Basic assurance level, you have only one option I year. If you select Medium Assurance level, you will be able to select from I year, 3 years and Unknown options. Request Reason: This allows you to provide information to the FIS Administrator why you need the certificates. NOTE: If you have any questions regarding the information that may be selected for these fields, refer to detailed information available on our customer site specific to FIS Request options. 3. User Information: Review the information in this section including your address and address. If you are requesting Medium level of assurance certificates, it is important that the address information is correct as this is the address where a trusted agent will be dispatched to complete in-person proofing. IMPORTANT: If you click to modify the information, please note that you will need to go through the change process first and once the change process is completed, you will need to restart the FIS request process.. 4. Click on Next to complete application access request. You will be presented with a confirmation page. IMPORTANT: if you have questions regarding the sponsor code to use, contact the sponsor, refer to the information on our customer site or Exostar Customer Support for additional information. What happens next? The FIS Administrator will receive a request for approving your FIS subscription. The FIS Administrator has the ability to modify your request. So contact your FIS Administrator if you have questions regarding the certificates you are approved for. Don t know how to find out who your FIS Administrator is? Click here. If you are approved for Basic level of assurance certificate, you will receive an approval with a passcode to download your certificates once the FIS Administrator approves your request. Refer to the Manage Certificates section for information on downloading your certificate. Copyright 2009 Exostar LLC. All rights reserved Page 15 of 58

19 If you are approved for Medium level of assurance certificate, after the FIS Admin approval, your request will be approved by Exostar for an in-person proofing session with a trusted agent. More information on this proofing session is available here. After successful proofing session, the trusted agent will provide you the passcode to download the certificates that you can use to download certificates once you receive the approval . Refer to the Manage Certificates section for information on downloading your certificate. In-Person Proofing Users that require MLOA software or MLOA Hardware certificates are required to go through in-person proofing with a trusted agent. You will be contact by a trusted agent to set-up a proofing appointment at your convenience. Make sure that you review the proofing requirements prior to your appointment and take all required documentation for your appointment. IMPORTANT: If you fail to bring all required documents to the proofing appointment, you may be invoiced additional charges for all subsequent appointments with the trusted agent. Pending Acceptance of Terms & Conditions If you are the Organization Administrator, you will see a View Service Agreement button next to Pending Acceptance. NOTE: Users within your organization will not be able to access the application until the Organization Administrator accepts the Service agreement for the application. To enable access to the application, complete the Service Agreement acceptance by following the steps below: 1. Click on View Service Agreement against an application to open the Service Agreement for review and acceptance. An example of the Service Agreement for the FIS application is presented below: Copyright 2009 Exostar LLC. All rights reserved Page 16 of 58

20 NOTE: For each application, the Service Agreement will have the same set of buttons as highlighted above. 2. After the reviewing the agreement, click on I Agree button to accept the agreement. The following screen is presented: 3. Complete this step for all subscribed applications. Users within your organization will not be able to request access to an application is the Service Agreements have not been accepted. What happens after accepting the Service Agreement? 1. You can subscribe a user to the application. For information on how to add a user/subscribe a user to an application, refer to the User Management Guide: 2. A user within your organization may subscribe to the application. Copyright 2009 Exostar LLC. All rights reserved Page 17 of 58

21 What happens if you do not accept the Service Agreement? 1. If you select Cancel : You will be taken back to the Applications page. 2. If you select I Do not Agree : Your application subscription will be remain pending and the View Service Agreement button will be made available again. 3. Users within your organization will not be able to access this application. Confirmations: When the Organization administrator completes the acceptance of the Service Agreement for an application, an confirmation is sent out by Exostar. View and Modify Account If you wish to change information regarding your account, you may do so by accessing the My Account tab after login. You will have the following options: Edit Profile Update Enterprise Access Gateway (EAG) Settings View Organization Details Change Password Change Change Security Questions Manage OTP Edit Profile The Edit Profile Page allows you to change your name and address information. 1. Click on My Account tab to view the Edit Profile page. 2. You will be able to update only the available fields. 3. Click the Continue button at the bottom. You will be presented with a confirmation page and an will be sent to the address on record. Copyright 2009 Exostar LLC. All rights reserved Page 18 of 58

22 IMPORTANT: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), your screen may look different. Refer to the section Update Enterprise Access Gateway (EAG) Account Settings for additional information. NOTE: Not all the profile information that you updated in the Portal will propagate across all of your Exostar-enabled applications. You will have to update application-specific profiles within the respective application. Restricted Access: ON/OFF setting is one of the factors that determine whether you can access Restricted Profile sites in ForumPass 4. If you have any questions regarding this setting, please contact your Organization Administrator. If you are not using ForumPass 4, this setting is of no relevance to you. Update Enterprise Access Gateway (EAG) Account Settings The option to update the EAG Account settings is available only to those users who belong to organizations that are subscribed to the EAG service. This option allows users to access all MAG applications via their corporate network login credentials. As a user belonging to an organization that is subscribed to EAG, your Edit Profile page will have an additional section to link your account to your network login credentials as highlighted below. Copyright 2009 Exostar LLC. All rights reserved Page 19 of 58

23 Link Accounts MAG User Guide To link your corporate login credentials with your MAG account, login to your MAG account and access the Edit Profile tab. Scroll down to the EAG account settings section at the bottom of the page and follow the steps below to complete the account-linking: 1. Click Link Accounts button under the Enterprise Access Gateway Account Settings section. 2. You will be prompted to save any changes you made to the Edit Profile page. Click OK of you want to save any changes to the Edit Profile page, else click the Cancel button to start the account linking process. 3. You will be prompted to save any changes you made to the Edit Profile page. Click OK of you want to save any changes to the Edit Profile page, else click the Cancel button to start the account linking process. Step 1 of Account Linking activities will be presented to you. Copyright 2009 Exostar LLC. All rights reserved Page 20 of 58

24 4. As highlighted above, your MAG Login ID will be displayed along with the Connect to Identity Provider and Cancel buttons. 5. Click on the Connect to Identity Provider button. You may be presented with a screen to choose a certificate. Refer notes below. IMPORTANT: If you logged in with you FIS certificates, you may be prompted to select a certificate that you logged in with. Select the certificate and click OK. If you don t have FIS certificates, but have a pending FIS certificate request, you may also be prompted for a certificate. Click on Cancel. 6. If you are already logged in to your corporate network, you will directly go to step 7 below. If you are not logged in, you will be prompted to provide your network login credentials in the next screen. Please note that this screen will be specific to your organization. 7. Step 2 of the Account Linking process will be presented to you. Notice your corporate network user ID is populated. Click on Link accounts button. This screen displays your MAG login ID and your corporate Login ID. In this example, you see the corporate user ID is defined as BAE Systems User ID. This is for example only. You will see the name of your organization instead of BAE Systems. Copyright 2009 Exostar LLC. All rights reserved Page 21 of 58

25 8. Following screen is presented with Step 3. Click on Logout and Close Browser to complete the account linking process. 9. Following logout screen is presented. Close the browser to complete the account linking process. What happens next? When you click on Logout and Close Browser button, you will be logged out of your current MAG session. A persistent cookie is saved on your machine to ensure that you are not required to authenticate again to MAG. To access MAG again, you will need to open a new browser and access the MAG page or use an existing Favorites link. You will be taken directly to the MAG applications page/ or the application that you accessed. If you are not logged in to your corporate network, you may be prompted to login. For FAQs related to EAG, refer to Lost EAG Cookie: Re-link accounts As mentioned above, a persistent cookie is stored on your machine when you complete the account-linking process. This cookie may be lost due to number reasons. 1. To re-link your corporate login credentials with your MAG account, access the MAG login page. The following screen will be displayed: Copyright 2009 Exostar LLC. All rights reserved Page 22 of 58

26 2. Click on EAG-enabled users click here as highlighted above. You may be prompted for an FIS certificate. Select the certificate that you use to access your applications and click OK or click Cancel if you don t have a certificate. 3. If you are not logged-in to your corporate network, you will be presented with the login screen. Enter your corporate login credentials on this screen. If you are already logged-in, you will be taken directly to the next step. 4. You will be presented with the MAG Applications page. A new persistent cookie will be automatically set-up to ensure that you are not prompted for MAG credentials again. Password reset and other user actions for EAG users If you are an EAG user, you will not be required to reset your password or remember your security questions. The following options under My Account tab will not be available: Change Password Change Security Questions View Organization Details Access the My Account tab and select View Organization Details. This tab provides you the information regarding the following: Organization Name and address details. Exostar Organization ID to reference in case of calling Customer Support. Subscribed Applications Organization Administrator contact information Application Administrator contact information per application Copyright 2009 Exostar LLC. All rights reserved Page 23 of 58

27 IMPORTANT: You will be able to view the Enterprise Access Gateway (EAG) Account Settings only if your organization has been linked to Enterprise Access Gateway (EAG). Copyright 2009 Exostar LLC. All rights reserved Page 24 of 58

28 Change Access the My Account tab and select Change . You will be able to change your address by going through the following steps: Step 1 - Enter your new address and click on 'Continue'. You will receive an activation code via to your new address. Step 2 - Enter the activation code from your and click on 'Activate'. Your new address will now be active in the system. IMPORTANT: 1. If you have valid FIS Certificates, you will need to revoke your certificates and then change the address. 2. If you have been approved for FIS certificates but have not yet downloaded the certificate and do not also have any other valid FIS certificates, you can modify your address. 3. You MUST notify all project partners of your address change to ensure that you continue to access the applications. 4. If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access Change tab. Copyright 2009 Exostar LLC. All rights reserved Page 25 of 58

29 Change Password Access the My Account tab and click on Change Password. Enter your current password, new password and confirm new password. Make sure that your new password complies with the Password Strength Policy as below: Must contain a minimum of 8 characters and a maximum of 12 characters. Must contain at least 4 distinct characters, 1 alphabetic character, 1 numeric character and 1 special character such as!,@,#,$,% etc. Leading and trailing spaces are not permitted. IMPORTANT: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access Change Password tab. Change Security Questions Access the My Account tab and click on Change Security Questions. If you wish to change a question/answer combination, click on the 'Change' check box. This will make the field editable. Make any modifications, and then click the 'Submit' button at the bottom of the page. Copyright 2009 Exostar LLC. All rights reserved Page 26 of 58

30 Please note the following regarding your Security Questions: Security questions are used when you've forgotten your password or when you need to change your password. The system will only require you to remember two of the four questions when resetting your password. Each of your question and answer combinations must be unique. The answers to the Security questions are case-sensitive. You cannot select the same question twice. IMPORTANT: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access Change Security Questions tab. Manage OTP Copyright 2009 Exostar LLC. All rights reserved Page 27 of 58

31 From the Manage OTP tab you can order, activate, and manage One-Time Password Hardware Tokens that can be used with your MAG account for authentication purposes. For more information, refer to the OTP Hardware Token User Guide. Manage Certificates If you have been approved for access to FIS, you will be able to view Manage Certificates under the My Account tab (see below). IMPORTANT: In certain situations the FIS user may not be able to obtain some or all of the permissions needed to download and install the Exostar ActiveX XEnrollPlus control via a web browser. To handle these situations, system administrators can use a Microsoft installer based package (MSI) to install the Exostar ActiveX control. There are three versions of the installer currently available one for Windows 2000 platforms, one for Windows XP and one for Windows Vista and can be downloaded here. Refer to the document links provided for specific information regarding certificate download requirements and common errors. Download Certificates Basic Level of Assurance (Identity) Pre-requisites for downloading the certificates: 1. Received 16-digit passcode from Exostar via 2. Reviewed the system and certificate download requirements document To download the certificates that you have been approved for, access My Account and click on Manage Certificates. Step 1: Enter the Passcode Copyright 2009 Exostar LLC. All rights reserved Page 28 of 58

32 You will receive the Passcode in an from Exostar acknowledging your approval for FIS subscription. IMPORTANT: The Passcode is a 16 digit number separated by hyphens, for example: You must enter all the characters including the hyphens. NOTE: The Passcode is NOT the same as your MAG login password. Step 2: Download Certificate If your Passcode is correct, you will see the certificate listed with status. The system will automatically select the certificate to download. NOTE: You will only be able to see Download Certificates sub-tab under Manage Certificates only when you have an approved FIS request pending certificate download. If no certificates are available for download, you will not view this subtab. After the certificate has downloaded successfully, you will see a confirmation message on your screen. Refer to the FAQ section for Federated Identity Service on for information on any errors encountered while downloading the certificates. Download Certificates Basic Level of Assurance (Secure ) Pre-requisites for downloading the certificates: 1. Received 16-digit passcode from Exostar via 2. Reviewed the system and certificate download requirements document To download the certificates that you have been approved for, access My Account and click on Manage Certificates. Copyright 2009 Exostar LLC. All rights reserved Page 29 of 58

33 Step 1: Enter the Passcode You will receive the Passcode in an from Exostar acknowledging your approval for FIS subscription. IMPORTANT: The Passcode is a 16 digit number separated by hyphens, for example: You must enter all the characters including the hyphens. NOTE: The Passcode is NOT the same as your MAG login password. Step 2: Archive Encryption key If your Passcode is correct, you will see the list of certificates that you can download. The system will automatically select all of them for download. Click on the 'OK' button to archive your encryption key and enable key recovery. NOTE: This activity will allow Exostar to archive the encryption key for recovery at any later time. Refer to Recover Encryption Keys section for details. Copyright 2009 Exostar LLC. All rights reserved Page 30 of 58

34 Step 4: Complete certificate download The system presents the status of the download at each step. Once the download is completed successfully, you will receive the following message screen. Refer to the FAQ section for Federated Identity Service (FIS) on for information on any errors encountered while downloading the certificates. Download Certificates Medium Level of Assurance (Software) Pre-requisites for downloading the certificates: 1. Completed in-person proofing. For more information click here. 2. Received 16-digit passcode from the proofer. Please note that if you lose this password, you will be required to go through the in-person proofing process again. 3. Reviewed the system and certificate download requirements document To download the certificates that you have been approved for, access My Account and click on Manage Certificates. Step 1: Enter the Passcode At the time of In-Person Proofing process, the proofer provided you a Passcode. This passcode will be valid only after you receive an acknowledgement from Exostar that your subscription has been approved. Copyright 2009 Exostar LLC. All rights reserved Page 31 of 58

35 IMPORTANT: The Passcode is a 16 digit number separated by hyphens, for example: You must enter all the characters including the hyphens. NOTE: The Passcode is NOT the same as your MAG login password. Step 2: Archive Encryption key If your Passcode is correct, you will see the list of certificates that you can download. The system will automatically select all of them for download. Click on the 'OK' button to archive your encryption key and enable key recovery. NOTE: This activity will allow Exostar to archive the encryption key for recovery at any later time. Refer to Recover Encryption Keys section for details. Step 3: Enable Strong Protection IMPORTANT: Exostar strongly recommends that you enable strong protection for your MLOA Certificates, unless there are corporate policies against the same. 1. Click on Set Security Level as highlighted below. Copyright 2009 Exostar LLC. All rights reserved Page 32 of 58

36 2. By default, Medium option will be selected. Change this to High and click Next. 3. Provide a password for this certificate. Please note that you will need to provide this password each time you use your certificate. Copyright 2009 Exostar LLC. All rights reserved Page 33 of 58

37 The system now displays the new security level. Click OK. Step 4: Download the certificates The system will prompt you for the password as set in step 3 to download the certificates. Once you enter the password, click OK. Copyright 2009 Exostar LLC. All rights reserved Page 34 of 58

38 The system presents the status of the download at each step. Once the download is completed successfully, you will receive the following message screen. Refer to the FAQ section for Federated Identity Service (FIS) on for information on any errors encountered while downloading the certificates. Download Certificates Medium Level of Assurance (Hardware) Pre-requisites To be able to download the MLOA Hardware certificates, you should have completed ALL of the following tasks: 1. Acquired appropriate tokens. (Please reach out to Exostar Customer Service if you do not already have the information) 2. Install token PKI Client middleware on your machine. (Reach out to your token vendor for appropriate information/your IT Support for organization specific information) 3. Initialize the token in FIPS mode. For more information on how to check for FIPS mode, refer to the Hardware Token FIPS Mode Review section for details. 4. Ensure you have been provided with the initial token password to enable you to complete token installation. Reach out to you vendor to receive the initial password. You will be required to enter a password for this token during the certificate download process. 5. Complete FIS MLOA Hardware Certificate In-person proofing process. For more information, click here. 6. Received the MLOA Hardware Certificate passcode from the Proofer at the end of the in-person proofing. Please note that if you lose this password, you will be required to go through the in-person proofing process again. Hardware Token FIPS Mode Review Exostar s Medium Level of Assurance Hardware digital certificates are 2048 FIPS compliant. To ensure that the tokens also comply with the FIPS compliance, review the token information. NOTE: You must review this information BEFORE downloading the digital certificates. Copyright 2009 Exostar LLC. All rights reserved Page 35 of 58

39 1. If you have completed the initial password change process for your token, plug-in your token to your USB drive. The following screen depicts the view presented to you for the Aladdin etoken PRO (72K) Java. IMPORTANT: Your view of the screenshots in the steps below may be different from what is presented in this guide. This is due to the token settings specific to your organization. 2. Click on View etoken Info as highlighted above to display the token details. Copyright 2009 Exostar LLC. All rights reserved Page 36 of 58

40 3. Make sure that the Supported Key size is 2048 (highlighted above). 4. Scroll through the list and search for FIPS Mode and Supported Key size under Name column. In the screenshot above, the token does not display information on FIPS Mode. At this time, you must follow the steps below to initialize your token in the FIPS Mode. IMPORTANT: Any certificates on the token will be invalid for FIPS 14-2 compliance. If you already have certificates installed on the tokens, you will need to re-initialize the token. Hardware Token FIPS Mode Initialization 1. Click on the Advance View icon on the PKI Client as highlighted below: 2. Click on etoken Pro Java to display the screen below and select the Initialize etoken icon (highlighted below) to display the initialize screen. Copyright 2009 Exostar LLC. All rights reserved Page 37 of 58

41 IMPORTANT: Your view of the screenshots may be different from what is presented in this guide. Your view is determined by the token settings specific to your organization. 3. Click on Advanced to display advanced settings. If this button is unavailable, contact your IT Administrator/FISA for additional information on how to set-up the token in the FIPS mode. 4. Click on the check box for FIPS mode to set-up the FIS mode for the token. Click OK to complete the change. 5. On the Initialize etoken screen, click Start. The following screen will be presented. Copyright 2009 Exostar LLC. All rights reserved Page 38 of 58

42 6. Select OK to start initialization. On successful initialization, you will receive the following message. 7. Click OK and go back to the PKI Client main screen and select View etoken Info. The FIPS Mode will appear as highlighted below. Copyright 2009 Exostar LLC. All rights reserved Page 39 of 58

43 Downloading certificates to your token: Step 1: Plug-in the token to your USB drive: As a first step, plug-in the hardware token to your machine s USB drive. IMPORTANT: You should have installed the PKI Client on your machine as well as changed the initial password of your token prior to starting the certificate download process. To download the certificates that you have been approved for, access My Account and click on Manage Certificates. NOTE: You will only be able to see Download Certificates sub-tab under Manage Certificates only when you have an approved FIS request pending certificate download. If no certificates are available for download, you will not view this subtab. Step 2: Enter the Passcode At the time of In-Person Proofing process, the proofer provided you a Passcode. This passcode will be valid only after you receive an acknowledgement from Exostar that your subscription has been approved. IMPORTANT: The Passcode is a 16 digit number separated by hyphens, for example: You must enter all the characters including the hyphens. NOTE: The Passcode is NOT the same as your MAG login password. Step 3: Download Certificate If your Passcode is correct, you will see the list of certificates that you can download. The system will automatically select all of them for download. Once selected, you will be prompted to enter the hardware token password. Copyright 2009 Exostar LLC. All rights reserved Page 40 of 58

44 Enter the token password and click on OK. The following message is presented: Click OK. The following screen is presented. NOTE: This activity will allow Exostar to archive the encryption key for recovery at any later time. Refer to Recover Encryption Keys section for details. Copyright 2009 Exostar LLC. All rights reserved Page 41 of 58

45 Once the process of archiving is completed, the following screen will be presented to you. Click OK to complete the installation process. You will be prompted again for your token password. Step 4: Import Certificates to token Enter your password and click OK to import the certificates to your token. Copyright 2009 Exostar LLC. All rights reserved Page 42 of 58

46 Click OK to complete the process. Refer to the FAQ section for Federated Identity Service on for information on any errors encountered while downloading the certificates. View Certificates (MAG) After you have successfully downloaded FIS certificates, you will be able to view the certificates and their details under the 'View Certificates' sub-tab. View Certificates (etoken for MLOA Hardware) 1. After installing the certificates, open the token client. The following screenshots depict the information specific to Aladdin etoken Pro 72 K token. Copyright 2009 Exostar LLC. All rights reserved Page 43 of 58

47 2. Click on advanced view (highlighted above). 3. Expand the User Certificates by clicking on the plus sign (+). You should view the list of all installed certificates. Click on each certificate to view details. Copyright 2009 Exostar LLC. All rights reserved Page 44 of 58

48 Revoke Certificates If you suspect one of the following, you should revoke your certificates: Loss, compromise or theft of your private key Fraud There are four ways to revoke your certificates: Yourself: Login to your MAG account using your User ID and password and follow the steps provided below. Organization Administrator: Your Organization Administrator can also revoke your certificates at any time. FIS Administrator: Your organization s designated FIS Administrator can revoke your certificates on your behalf. Exostar Customer Support: If your certificates have been compromised, you can contact Exostar Customer Support and request certificate revocation. 1. To revoke your certificates, access My Account and click on Manage Certificates. 2. Click on Revoke Certificates tab. IMPORTANT: You will not be able to selectively revoke certificates. This activity will revoke all of the certificates that you have downloaded. Copyright 2009 Exostar LLC. All rights reserved Page 45 of 58

49 3. Click on 'Revoke' button to revoke ALL of your FIS certificates. You will not be able to selectively revoke your certificates. The following screen is presented. 4. Select OK to revoke all certificates. Certificate Revocation Confirmation is presented (see next page). Copyright 2009 Exostar LLC. All rights reserved Page 46 of 58

50 If you attempt to View Certificates, the following screen is presented: Recover Encryption Keys IMPORTANT: This section is pertinent ONLY to users with BLOA (Secure ), MLOA (Software) and MLOA (Hardware) certificates. A user receives three certificates for FIS BLOA (Secure ) and MLOA (both Software & Hardware): Identity; Authentication; and Encryption. Once a user revokes or loses their MLOA certificates, they will need to re-apply for certificates and go through the in-person proofing activity. To enable the users to access data encrypted using the revoked/lost certificates, Exostar offers the self-key recovery functionality to users. IMPORTANT: If you are approved for and have downloaded FIS BLOA (Secure ) certificates, you can recover encryption keys for all active, revoked or expired BLOA(Secure ) certificates. If you are approved for and have downloaded FIS MLOA (Software) certificates, you can recover both BLOA(Secure ) and MLOA(Software) encryption keys for all active, revoked or expired certificates. If you are approved for and have downloaded FIS Hardware certificates, you can recover encryption keys for all certificates BLOA(Secure ), MLOA(Software) and MLOA(Hardware). However, for hardware certificates, you will be able to recovery only expired/revoked encryption keys. Current keys cannot be recovered. If you are recovering Hardware encryption keys, you need to be logged in using Hardware tokens. You can use the keys to only access the data that was encrypted using the revoked/lost certificates. To recover the keys, follow the steps below: 1. Login to your MAG account using your new MLOA certificates. If you have not yet re-applied for certificates, complete all the activities related to requesting, in-person proofing and downloading your certificates prior to attempting to recover Encryption keys. Refer to the Reapply for Certificates section for information on re-applying for certificates. The following screen is presented if you have not logged-in using your new certificates. Click on the link to select the certificate associated with your login credentials. Copyright 2009 Exostar LLC. All rights reserved Page 47 of 58

51 2. Click on the Recover Encryption Keys tab under Manage Certificates. 3. Select the certificate for which you need to recover the encryption key. Note that if multiple certificates are available, you will need to repeat the process to recover each key. The following screen is presented. Copyright 2009 Exostar LLC. All rights reserved Page 48 of 58

52 4. Click on OK. On the Choose a digital certificate pop-up, select the certificate that was used to login. 5. You may be prompted to login again using your MLOA certificate. Complete the login with the MLOA certificate used to login in step 1 and click on OK. The following screen is presented. Click on Download. Copyright 2009 Exostar LLC. All rights reserved Page 49 of 58

53 6. You will be prompted to take an action to open or save the file. Select Save by clicking on the save button. MAG User Guide 7. Save the certificate file (.p12 format) at a location of your choice. Click Close as highlighted above on the Exostar Self Key Recovery screen. 8. You will receive an with a one-time use password required to unlock the file that you have just downloaded. Follow the instructions under section Importing Recovered Encryption Keys for next steps. Copyright 2009 Exostar LLC. All rights reserved Page 50 of 58

54 Importing Recovered Encryption Keys To import the encryption recovered in section Recover Encryption Keys, you will need the following: 1. Access to the location where you saved the.p12 file from step 7 of Recover Encryption Keys. 2. with the one-time passcode to unlock the key for importing (step 8 of Recover Encryption Keys). Follow the steps below to import your encryption key: 1. Double click on the saved.p12 file. MAG User Guide 2. You will be presented with the Certificate Import Wizard. Click Next. 3. Confirm the filename and click Next. Copyright 2009 Exostar LLC. All rights reserved Page 51 of 58

55 4. Confirm the filename and click Next. 5. Copy or enter the one-time password from the in step 8 of Recover Encryption Keys making sure no trailing spaces are entered. In addition, it is strongly suggested that you enable strong key protection and set-up a password to access the encryption key. To enable further export of the key, you may also select Mark this key as exportable option. 6. Click Next. You will be prompted to select a location to store the certificate. Click Next again. Copyright 2009 Exostar LLC. All rights reserved Page 52 of 58

56 7. Click Next again to complete the import process. Click on Finish. 8. If you selected to Enable strong protection in step 5 above, you will be presented the following screen. 9. Click on Set Security Level to set a password for the encryption key. Copyright 2009 Exostar LLC. All rights reserved Page 53 of 58

57 10. Select High to ensure that you are prompted for a password each time. Click Next. 11. Enter a password and click Finish. You will be presented the same screen as in step 8. Click OK and the following screen will be presented. When you attempt to open an encrypted document/ that was encrypted using this key, you will be automatically prompted for the key password that you have set-up in step 10. Enter the password to access your document/ . Copyright 2009 Exostar LLC. All rights reserved Page 54 of 58

58 Renew Certificates MAG User Guide You may renew your certificates 90 days prior to expiration. If you have expiring certificates, you must not re-apply for certificates unless you are attempting to upgrade the certificate assurance level. Only you can submit a certificate renewal request. An Organization administrator or the FISA cannot submit a certificate renewal request on your behalf. For detailed information on renewing your certificates, refer to the FIS Certificate Renewal/Reapply Guide. Reapply for Certificates You may reapply for certificates for any of the following reasons: Your certificates have been revoked Your certificates have expired You want to upgrade the certificate assurance level Your Organization Administrator has instructed you to reapply for FIS certificates There are three ways to reapply for your certificates: Yourself: Login to your MAG account using your User ID and password and follow the steps provided below. Organization Administrator: Your Organization Administrator can also reapply for certificates on your behalf! Exostar Customer Support: If you are unable to request certificates yourself or the Organization Administrator is unable to request them on your behalf, contact Exostar Customer Support. Click on 'Reapply' button and follow the instructions on the screen. Account Disablement If your account is in a state of inactivity, it may get suspended or deleted. Here are the reasons why your account may get deleted or suspended: First Time Login not completed for more than 180 days If you have not completed First Time Login (account activation) for your MAG account, your account will be deleted. You will be notified 30 days prior to the deletion date with instructions on how to complete First Time Login. Application access suspension Each application can set the parameters for the number of days of inactivity that will lead to access suspension. If your application access is due for suspension in 30 days or less, each time you login to your MAG account, you will be presented with a flash screen to remind you to access the application and the number of days to suspension. To ensure that you do not lose access to the applications you need, it is a good practice to login to your MAG account regularly and access available applications. Copyright 2009 Exostar LLC. All rights reserved Page 55 of 58

59 Application access deletion If your application access has been suspended for x number of days as specified by the application owner, your access to the application will be deleted. You will be notified regarding this deletion 30 days in advance. Active account deletion: If the last active application subscription is suspended, your MAG account will be suspended 30 days after the application suspension. You will be notified regarding this suspension 30 days in advance. Contact Exostar Customer Support for information on how to re-establish application access. Frequently Asked Questions (FAQs) Listed below are some FAQs related to MAG. For additional FAQs, click here. Q: What is the difference between One Time Password and System Generated Password? A: One Time Password is a manually-created password that was provided by your Organization Administrator. This must be used when you login for the first time. One Time Passwords are used as an additional security measure to verify your account during First Time Login. This password is different from the passwords generated from a One-Time Password Hardware Token. System Generated Password is the password that was sent via when your account was created. This must be used during First Time Login. All the above passwords can only be used once. Q: How do I know who the Administrator(s) is for my Organization? A: There may be multiple Administrators for your organization. Refer to the View Organization Details section for details. Q: Why don't I see the Administration tab after I log in? A: If you have not been designated as an Administrator within MAG, you will not see the Administration tab. For further information on becoming an Organization Administrator, please contact your current organization administrator. Q: What do I do if I don't have my Passcode for certificate download? A: Contact Exostar Customer Support. Q: Why do I receive the disabled account error when I try to login? You will receive the above message when the Organization Administrator or Exostar has disabled your account. You will not receive any notification when your account is disabled. Please reach out to your Organization Administrator for details. Q: Why do I receive the Invalid Login ID or Password error when I try to login? Copyright 2009 Exostar LLC. All rights reserved Page 56 of 58

60 You receive this error in two scenarios: You have entered your logon credentials incorrectly: Try again using your correct User Name and password. If you have forgotten your password, follow the instructions provided in the Forgotten Password section for details on requesting a new password. Your account has been deleted: If your account has been deleted by the Organization Administrator of your organization, your logon credentials have been disabled. Please reach out to your Organization Administrator for details. If you need to have a valid account, you will need to complete the User Registration process again. Q: Why do I get an error You are currently not logged in with your certificates when I attempt to renew my certificates? A: This error message is presented when the user is attempting to renew certificates but is not logged in with the expiring certificates. Click on the link highlighted in blue in the error message and you will be presented with the certificate selection list (if your IE is set to present the certificates to choose) or the system will automatically pick up a valid certificate and complete the login process. You should then the renew button if your certificate is eligible for renewal. Q: When attempting to renew my certificates, I get an error message stating that my certificate is not eligible for renewal? Copyright 2009 Exostar LLC. All rights reserved Page 57 of 58

61 A: This message is presented if your certificate is not eligible for renewal. A certificate can be renewed any time from 90 days prior to the expiration date to the date of expiry. Q: Why do I get an error message when I attempt to login using my certificates or when I attempt to upgrade my login credentials during certificate renewal? A: Follow the link provided in the error message for detailed information on how to resolve this error. Copyright 2009 Exostar LLC. All rights reserved Page 58 of 58