User Guide. Version 3.0

Transcription

1 User Guide Version 3.0

2 CONTENTS CHAPTER 1 - INTRODUCTION...3 SYSTEM REQUIREMENTS...3 PROFESSIONAL LICENSE...3 CHAPTER 2 - ACTIVE DIRECTORY INTEGRATION...4 HOW IT WORKS...4 ACTIVE DIRECTORY REQUIREMENTS...4 INTEGRATION CHECKLIST...4 SITE CODE AND CARD NUMBER ATTRIBUTES...5 PIN CODE ATTRIBUTE...6 GROUP FILTER ATTRIBUTE...6 CREATE A PERIPHERAL...7 NO RULES...14 CHAPTER 3 - OUTLOOK INTEGRATION...15 HOW IT WORKS...15 OUTLOOK INTEGRATION REQUIREMENTS...15 INTEGRATION CHECKLIST...16 CALENDAR PERMISSIONS...16 CREATE A PERIPHERAL...16 CREATE RULES...21 CREATE AN UNLOCK ZONE RULE...21 CREATE A REVERT ZONE RULE...22 CREATE A MEETING...23 CHAPTER 4 - GOOGLE CALENDAR INTEGRATION...24 HOW IT WORKS...24 GOOGLE CALENDAR INTEGRATION REQUIREMENTS...24 INTEGRATION CHECKLIST...24 CREATE A PERIPHERAL...24 CREATE RULES...30 CREATE AN APPOINTMENT...30

3 CHAPTER 1 - INTRODUCTION Thank you for purchasing Intelli-M Access Professional, the Simple, Scalable, and Secure access control system, designed for the small business, and scalable for the enterprise. This guide will assist in configuring and managing your Intelli-M Access Professional system. Intelli-M Access Professional extends Intelli-M Access Essentials by providing integrations with Microsoft Active Directory, Microsoft Exchange and Google Calendar. These features allow you to manage Intelli-M Access users from within Active Directory, and lock and unlock Doors via Meetings or Appointments on your calendar. If you do not have Intelli-M Access Professional, please contact infinias sales for information on obtaining the latest version of Intelli-M Access Professional. This document also applies to Intelli-M Access Corporate edition. SYSTEM REQUIREMENTS Intelli-M Access Professional is recommended to be run on a server-class operating system such as Windows Server 2003 and Windows Server 2008/2008 R2. Please refer to the Intelli-M Access Essentials User Guide for additional system requirements and installation information. For Active Directory integration, the server on which you have installed Intelli-M Access must be a member of the Windows Domain in your organization. Furthermore, the Domain Controller must be running Windows Server 2003 or newer - Server 2000 and older Domain Controllers are not supported. Finally, if your installation does not require Active Directory integration, this requirement can be ignored. For Microsoft Exchange integration, Microsoft Exchange 2007 or newer is required. Exchange 2003 and earlier are not supported as they don't provide the necessary integration features. If your installation will not be using Exchange integration, this requirement can be ignored. For Google Calendar integration, all that is needed is a valid Google Mail address. PROFESSIONAL LICENSE Intelli-M Access Professional is a licensed upgrade to Intelli-M Access Essentials. If you have Intelli-M Access Version 3.0 or newer installed, all you need to do is update the License information with your new Professional License Key. For information on entering a license key, please refer to the System Settings section of Chapter 6 in the Intelli-M Access Essentials User Guide.

4 CHAPTER 2 - ACTIVE DIRECTORY INTEGRATION Intelli-M Access Professional can integrate with the Active Directory Server in your organization to allow the Active Directory Administrator to manage Intelli-M Access cardholders within the Active Directory User management system rather than within the Intelli-M Access User Interface. This integration provides the convenience of not having to learn and use yet another user management system on a daily basis. HOW IT WORKS Intelli-M Access Professional is unlike most Active Directory integrations in that it does not merely authenticate the provided credentials to Active Directory for a pass/fail result. Instead, it queries Active Directory for real-time changes to its User database, and reflects those changes within the Intelli-M Access database. This means that Intelli-M Access continues to maintain the same user configuration and database that it had before the integration - it simply gets its updates from another source (Active Directory), rather than from the Intelli-M Access User Interface. Active Directory integration will manage all of the attributes associated with a Person, including the Person's Group membership(s). Therefore, you can manage First Name, Last Name, all contact information, Employee Id, and even the card number associated with that Person within Active Directory's User management tools. Although Active Directory can modify Intelli-M Access users and groups, that integration is one-way: at no time does Intelli-M Access modify Active Directory with its own data, even if you continue to use the Intelli-M Access User Interface to configure cardholders. Note: it is strongly recommended that you do not attempt to modify Persons in Intelli-M Access once you have established Active Directory integration. Any changes you make are likely to be overwritten by the next change made to the same user in Active Directory. The exception to this recommendation is multiple credentials - you can continue to manage multiple credentials for a cardholder in Intelli-M Access. Just make sure you allow Active Directory to manage the first cardholder (the one shown in the Person Summary). ACTIVE DIRECTORY REQUIREMENTS Active Directory integration requires that the server on which you have installed Intelli-M Access be a member of the Windows Domain in your organization. Furthermore, the Domain Controller must be running Windows Server 2003 or newer - Server 2000 and older Domain Controllers are not supported INTEGRATION CHECKLIST The Active Directory integration effort will require you to interface closely with the IT representative in your organization. Intelli-M Access will map Active Directory attributes such as First Name, Last Name, etc with IntelliM Access Person and Group items, such as First Name, Last Name. Many of these mappings are performed for you automatically, but some are not. The following is a complete list of all Active Directory User attributes that are implicitly understood to map into Intelli-M Access (First Name and Last Name are not shown below because their mappings are hard-coded). Intelli-M Access Item Title Active Directory Attribute personaltitle

5 Department Department Company Company Job Title Title Phone Number telephonenumber Cell Phone Mobile Office physicaldeliveryofficename Primary Mail Employee Id employeeid Notes description The Active Directory attributes are exactly what you see in the 'Active Directory Users and Computers' administration utility on the Domain Controller. You can find a fairly exhaustive list of these attributes and their definitions at Note: You must enable 'Advanced Features' in the 'Active Directory Users and Computers' utility in order to see the attributes in the form you see in the table above. To enable Advanced Features, click the 'View' menu and check the 'Advanced Features' menu item. Once enabled, when viewing the Properties of any Active Directory object, an 'Attribute Editor' tab will be visible among the numerous other tabs. The Attribute Editor tab contains all of the known attributes and their values, which you can modify directly if you wish. In addition to the mappings above, you can map all of the remaining Intelli-M Access Person items to Active Directory attributes. In all cases, coordinate these mappings with your IT representative to ensure that the proper attributes are being used for the mappings. Once you have decided which attributes to use, memorize or document the chosen attributes so you can later provide that information to Intelli-M Access. SITE CODE AND CARD NUMBER ATTRIBUTES Once you have the basic mappings of Active Directory attributes and Intelli-M Access Person items completed, you must decide which Active Directory attributes are to be mapped to represent the Person's Site Code and Card Number. Note: Intelli-M Access requires a valid Site Code and Card Number in order to create a Person, so you cannot skip this step. Unlike the table above, there is no obvious mapping for these items so you must work with the IT representative to decide which Active Directory attributes will be reserved to represent the Site Code and Card Number. Optionally, you can also create custom Active Directory attributes, but this is not required. By default, Intelli-M Access Professional maps the Side Code to the Windows User's FAX Number and maps the Card Number to the Windows User's Pager Number. Windows User's typically do not have their own private FAX number, and also typically do not carry pagers in the smartphone world in which we live - therefore, these fields are usually no longer in use. If your IT representative approves of reserving these two fields in Active Directory for the Site Code and Card Number, then you need to do nothing more as the software will automatically map these attributes for you.

6 Figure 2.1 shows an example Properties dialog for the user 'Phil Jackson' where the Site Code has been written into the 'Fax' field and the Card Number has been written into the 'Pager' field. Figure User Properties Dialog PIN CODE ATTRIBUTE You can also optionally reserve an Active Directory attribute to be used as the PIN code for the user. Just repeat the steps described above for choosing the attribute and memorize or document the choice. GROUP FILTER ATTRIBUTE Active Directory contains numerous Groups that are not only of no value to Intelli-M Access, but also clutter up the Intelli-M Access Groups page with numerous unnecessary Group names. Groups such as "DHCP Administrators", "DnsAdmins", "Allowed RODC Password Replication Group", and so on are examples of Groups that Active Directory needs but Intelli-M Access does not. Therefore, Intelli-M Access allows for filtering unwanted Groups from being copied from Active Directory. Intelli-M Access maintains a "Group Filter" that reserves an Active Directory attribute to be used to represent a Group that Intelli-M Access needs. By default, Intelli-M Access reserves the 'extensionattribute1' attribute, which is an attribute for Windows Domain Groups. By setting the value at extensionattribute1 to "infinias", you are telling Intelli-M Access that this Groups belongs in Intelli-M Access. As with Site Code and Card Number, you must work with the IT representative to determine which Group attribute may be reserved for this purpose. Figure 2.2 below shows an example of a Windows Group that has been identified as belonging in Intelli-M Access:

7 Figure "Tech Support" Group Properties Page All Groups that do not have the "infinias" label in the specified attribute will not be copied to Intelli-M Access. Important Note: it is strongly recommended that you first complete this checklist and make the necessary changes within Active Directory before moving to the next section in this document. This includes setting the Group Filter attribute and updating all relevant Windows Users with their appropriate Site Code and Card Number. CREATE A PERIPHERAL Once you have chosen which User attributes to map and also chosen the Group Filter attribute to use, login to Intelli-M Access and proceed to the Peripherals Page. Click the 'Create Peripheral' command in the Actions Menu, and a Create Peripheral Dialog will appear, as shown in Figure 2.3:

8 Figure Create Peripheral Dialog Click the New menu to see the available plugins to use as Peripherals, and you should see a menu with one or more menu items, as shown in Figure 2.4: Figure Create New Menu Popup If you do not see 'ActiveDirectory Connection' in the popup menu, click the Discover button and wait several seconds for Intelli-M Access to re-discover the plugins, then click the New button again. If you still do not see the ActiveDirectory menu item, please verify that you are using a licensed Intelli-M Access Professional installation. If

9 the plugin installation proceeded correctly, you will see the ActiveDirectory entry among the other menu items in the popup menu. Select the 'ActiveDirectory Connection' menu item to start creating the Peripheral based on this plugin, and a Create New ActiveDirectory Connection popup dialog will appear, as shown in Figure 2.5: Figure New ActiveDirectory Connection Popup Dialog This is the configuration page where you will apply the mapping between the fields that describe a Person in the Intelli-M Access (the labels on the left side of the UI) and Active Directory Attributes (the text fields on the right side of the UI). The Active Directory Attribute names must be spelled exactly and are case-sensitive. The only Active Directory Users that will be transferred to Intelli-M Access are Users who have a Site Code and Card Code field mapping. Because Active Directory has no concept of Site, Card Code, or PIN Code, you must map a currently-unused object in Active Directory to these fields. The default value for Site Code,

10 (facsimiltetelephonenumber) and Card Code (pager) are shown in the example figure. There is no default mapping supplied for the PIN Code. Most of the remaining mappings are created for you by default using the obvious choices, such as for the Primary Address. Simply map the remaining fields that are important to you. Domain: Enter the part of your Exchange address that's on the right side of the character. Site Code: Provide an unused Active Directory Attribute that you wish to re-use and map to the Site Code (aka Facility Code) of the User's card number. Card Code: Provide an unused Active Directory Attribute that you wish to re-use and map to the User's Card Code (Card Number). Title: Provide the Active Directory Attribute that you wish to map to the User's name prefix (e.g. Mr., Mrs., Miss, etc). The personaltitle Attribute is used by default. Suffix: Provide the Active Directory Attribute that you wish to map to the User's name suffix (e.g. Jr., Esq., etc). No default Attribute is provided. Department: Provide the Active Directory Attribute that you wish to map to the User's company department membership. The department Attribute is used by default. Company: Provide the Active Directory Attribute that you wish to map to the company at which the User is employed. The company Attribute is used by default. Office: Provide the Active Directory Attribute that you wish to map to the office in which the User is employed. The physicaldeliveryofficename Attribute is used by default. Building: Provide the Active Directory Attribute that you wish to map to the building in which the User is located. There is no default Attribute Job Title: Provide the Active Directory Attribute that you wish to map to the User's job title. In Intelli-M Access, the Job Title is referred to as the Position. The title Attribute is used by default. Phone Number: Provide the Active Directory Attribute that you wish to map to the User's office phone number. The telephonenumber Attribute is used by default. Phone Extension: Provide the Active Directory Attribute that you wish to User's telephone extension, if it exists. There is no default Attribute Cell Phone: Provide the Active Directory Attribute that you wish to map to the User's cell phone number. The mobile Attribute is used by default. License Plate: Provide the Active Directory Attribute that you wish to User's automobile license plate. There is no default Attribute Primary Provide the Active Directory Attribute that you wish to map to the User's work address. The Attribute is used by default.

11 Secondary Provide the Active Directory Attribute that you wish to User's personal or secondary address, if it exists. There is no default Attribute PIN Code: Provide an unused Active Directory Attribute that you wish to re-use and map to the Site Code (aka Facility Code) of the User's card number. Employee Id: Provide the Active Directory Attribute that you wish to map to the User's employee ID, if it exists. The employeeid Attribute is used by default. Notes: Provide the Active Directory Attribute that you wish to map to any notes written by the Administrator about the User's account. The description Attribute is used by default. User Attribute: Active Directory normally creates a Canonical Name of Users for every Windows User Account. This name appears in the Distinguished Name as 'CN=Users'. The Active Directory plugin relies on 'CN=Users' to tell the difference between a Windows User Account and all other objects in Active Directory. Organizations often re-use the CN attribute to denote organizational hierarchy, and change the name 'Users' to something else. If your organization has modified the canonical name, then we strongly recommend that you add 'Users' to your list of Organizational Units (i.e. OU=Users). If you cannot make this change, then enter the name that you used to replace 'CN=Users' in the User Attribute field. Group Attribute: The Group Attribute lets you specify which Active Directory Groups should be transferred to Intelli-M Access and which ones should not. If you leave this attribute field blank, all Active Directory Groups will be transferred. To designate one or more Groups for transfer, apply the following steps: 1) Choose an unused attribute in Active Directory that you can reserve for this purpose. A typical attribute to use is one of the unused extension attributes, e.g. 'extensionattribute1', 'extensionattribute2', 'extensionattribute3', etc. 2) Using the Active Directory Users and Groups utility, enter the string 'infinias' (without the quotes) in the attribute for all Groups that you wish to be transferred to Intelli-M Access. 3) Enter the attribute name you chose into the Group Attribute field in the configuration UI. For example, if you chose 'extensionattribute1', then enter 'extensionattribute1' (without the quotes) into this field. Immediate Transfer Users and Groups: This checkbox will connect to Active Directory and request its entire database of Groups and Users, transferring the information into Intelli-M Access. Important Note: no User will automatically transfer to Intelli-M Access until it has been configured with a Site Code and Card Number, as well as have its User Attribute set properly in Active Directory. No Group will automatically transfer until you have placed "infinias" in the specified Group Attribute in Active Directory. When you have finished filling out the fields, press the 'Create AD Monitor' button. The window will update to show a progress indicator while Intelli-M Access connects to the Active Directory server using the supplied information, as shown in Figure 2.6 below:

12 Figure Active Directory Progress Popup The system will then connect to the Domain Controller and start listening for changes to the Windows Users and Groups. If you checked the 'Immediately Transfer Users and Groups' checkbox, it will also start the process of downloading all appropriate Users and Groups to Intelli-M Access. This download process will run in the background as it may take several minutes or hours to complete. If you entered the correct server information, the progress will complete and a new entry in the Discovered Devices list will appear, as shown in Figure 2.7:

13 Figure New Active Directory monitor added to Devices list Click the newly-added Device, and the device's name and configuration will appear to the right, as shown in Figure 2.8 below: Figure Device Name and Configuration The Name field defines the actual name of the Peripheral as it is understood by Intelli-M Access. Change the name from its default to your liking, and press the 'Create' button. The Peripheral will now be created, and shown as a Peripheral along with Room Mailbox names in the Peripherals page, as shown in Figure 2.9:

14 Figure Created Peripheral 'Active Directory (DOMAINSERVER.infinity.us)' NO RULES Unlike other Peripherals, the behavior of the Active Directory Peripheral is fixed -- it updates Intelli-M Access whenever a corresponding change is made in Active Directory. Therefore, no further action is necessary.

15 CHAPTER 3 - OUTLOOK INTEGRATION Intelli-M Access Professional can integrate with the Microsoft Exchange Server installed in your organization to allow Outlook Meetings or Appointments to automatically unlock and re-lock doors controlled by Intelli-M Access. This form of ad-hoc scheduling allows you to manage the lock status of a Door that doesn't operate on a predictable schedule like office or retail business hours. Sporting events, party reservations at public buildings or churches are typical examples of scenarios that Outlook Calendar integration can be useful. If your organization does not have Microsoft Exchange, you can use the Google Calendar integration explained in Chapter 4. HOW IT WORKS Intelli-M Access Professional is designed to act as a way for Microsoft Exchange to send Meeting Reminder, Meeting Started, and Meeting Ended Events to Intelli-M Access for specified Exchange Room Mailboxes. The integration plugin accomplishes this task by monitoring the Calendar of each specified Exchange Room Mailbox. Therefore, whenever a Meeting or Appointment is scheduled in the Calendar of a Room Mailbox being monitored, the Intelli-M Access Exchange integration will send Events to Intelli-M Access informing it of these Calendar Events. A "Meeting Started" Event will be sent to Intelli-M Access the moment that a meeting is scheduled to begin, and a "Meeting Ended" Event will be sent to Intelli-M Access the moment that a meeting is scheduled to end. If you also requested Exchange to send out Meeting Reminder notifications to the required attendees, the plugin will also send "Meeting Reminder" Events to Intelli-M Access at this time as well. These Events appear in Intelli-M Access no differently than any other Event, and can therefore be configured for use on the Rules page like any other Event. The most common usage for these Events is to unlock and re-lock meeting room or public-access doors. For example, Intelli-M Access can be programmed to unlock a door when Exchange sends the Meeting Reminder or Meeting Start Events, and programmed to re-lock the door (or revert the door schedule) when the Meeting Ended Event occurs. Once you have configured the unlock/revert Rules in Intelli-M Access, all you have to do is create Meetings or Appointments in Outlook to control the meeting room door. These features are accomplished by monitoring the Calendar of a Exchange Room Mailbox. A Room Mailbox is simply an ordinary Exchange user account that is pre-configured to automatically accept all Meeting or Appointment requests in Outlook. When you create a Meeting or Appointment, you add a Room Mailbox to the 'Resources' list. Adding a Room Mailbox to the Resources list reserves that room for that time period, preventing anyone else from organizing a Meeting or Appointment for that room at the same time of day. In addition, that Meeting gets automatically added to that Room Mailbox's Calendar. Intelli-M Access monitors the Room Mailbox's Calendar so it can know when to send the Events described earlier. As Meetings or Appointments are added, moved or deleted from the Room Mailbox Calendar, Intelli-M Access will be able to monitor these changes. In order to monitor a Room Mailbox's Calendar, Intelli-M Access must be logged into Exchange with a valid Exchange User account, and Exchange must be configured to allow this User account to view the Room Mailbox's Calendar. The steps to accomplish these tasks is described in the integration checklist below. OUTLOOK INTEGRATION REQUIREMENTS Intelli-M Access Professional requires Microsoft Exchange 2007 or newer. Exchange 2003 and earlier are not supported as they don't provide the necessary integration features. If you do not have Microsoft Exchange, or if you do not have the required Exchange version, you can use the Google Calendar integration described in the next chapter.

16 INTEGRATION CHECKLIST You will need to provide several pieces of information about Microsoft Exchange to the Intelli-M Access Exchange plugin when you configure it, so be prepared to have the following information available: Internet Domain. You'll need to know the internet domain name that Exchange uses for creating its addresses, i.e. the part of your Exchange address that's on the right side of the character. Exchange User Account. You'll need to know the chosen Exchange User account (and its password) that you specified for Calendar permissions in the Exchange Management Console. WebMail Url. Intelli-M Access logs into Exchange via Exchange Web Services (formerly known as WebDAV) to monitor the requested Calendars, using the ordinary Mailbox account you specified. The Url that you use to read your webmail in a web browser is similar to the Url that you'll need, so keep that Url handy. Room Mailbox Addresses. You'll need to know the address of each Room Mailbox you gave Full Access Permissions to the ordinary Mailbox account in the Exchange Management Console. These addresses will be used by the Intelli-M Access plugin to know which Room Mailbox accounts to monitor. Once you have secured this information, you are ready to install and configure the Exchange integration. Configuration of the Exchange Calendar is performed by creating an Intelli-M Access Peripheral, then referencing that Peripheral when you create one or more Rules designed to utilize that Peripheral. CALENDAR PERMISSIONS Integrating Microsoft Exchange with Intelli-M Access means you must configure Exchange to allow an ordinary Exchange Mailbox account to have Full Access Permission rights to each Room Mailbox account whose Calendars you wish to monitor. While you can use any Exchange Mailbox account for this purpose, we recommend that you create a Mailbox account specifically for monitoring Calendars. Note: Administrator Mailbox accounts do not automatically have Full Access Permission rights to anyone's Calendar - you must specific assign these rights. To provide Full Access Permission rights which will allow the Mailbox to monitor the Room Mailbox Calendars, open the Microsoft Exchange Management Console. In the tree view on the left side of the console window, click the plus sign to open the 'Microsoft Exchange On-Premises (...)' item, then click the plus sign to open the 'Recipient Configuration' item. Select the 'Mailbox' item to view all Exchange Mailboxes in the right side view. Right-click each Room Mailbox you wish to manage, and select the 'Manage Full Access Permission...' menu item. Follow the wizard's instructions to add the chosen ordinary Mailbox account to the list of accounts that have full access permissions to this Room Mailbox. Perform this same task for all Room Mailboxes that represent areas with doors being managed by Intelli-M Access. CREATE A PERIPHERAL Login to Intelli-M Access and proceed to the Peripherals Page. Click the 'Create Peripheral' command in the Actions Menu, and a Create Peripheral Dialog will appear, as shown in Figure 3.1:

17 Figure Create Peripheral Dialog Click the New menu to see the available plugins to use as Peripherals, and you should see a menu with one or more menu items, as shown in Figure 3.2: Figure Create New Menu Popup If you do not see 'Exchange Calendar' in the popup menu, click the Discover button and wait several seconds for Intelli-M Access to re-discover the plugins, then click the New button again. If you still do not see the Exchange Calendar menu item, please verify that you are using a licensed Intelli-M Access Professional installation.

18 If the plugin installation proceeded correctly, you will see the Exchange Calendar entry among the other menu items in the popup menu. Select the 'Exchange Calendar' menu item to start creating the Peripheral based on this plugin, and a Create New Exchange Calendar popup dialog will appear, as shown in Figure 3.3: Figure New Exchange Calendar Popup Dialog Domain: Enter the part of your Exchange address that's on the right side of the '@' character. Username: Provide the username of the ordinary Mailbox account you previously gave Full Access Permissions to the Room Mailboxes in Exchange Management Console. Enter just the username portion of the account, not its address. Password: Provide the password for the user account you entered above. WebMail Url: Replace the "mail.mycompany.com" portion of the sample WebMail Url with your corporate webmail name. Since you are using Exchange 2007 or 2010, the remainder of the Url is already set properly for you. Room Mailboxes: For each Room Mailbox you have previously configured, enter the address of each conference room, separating each address with the comma (,) character. The window will update to show a progress indicator while Intelli-M Access connects to the Exchange server using the supplied information, as shown in Figure 3.4 below:

19 Figure Exchange Calendar Progress Popup For each Room Mailbox you specified, the Exchange plugin will send Intelli-M Access three test Events: one for Meeting Reminder, one for Meeting Started, and one for Meeting Ended. The purpose for these test Events is so Intelli-M Access will be informed of the Room Mailbox names and the Events they will generate. This in turn allows Intelli-M Access to be able to display this information on the Rules page for creating Rules. If one or more pieces of information was entered incorrectly on the Create Peripheral popup, or if there is some other connectivity issue like a firewall blocking the port, the previous configuration page will appear, giving you the ability to adjust the values you entered and try again. If you entered the correct server information, the progress will complete and a new entry in the Discovered Devices list will appear, as shown in Figure 3.5:

20 Figure New Exchange Device added to Devices list Click the newly-added Device, and the device's name and configuration will appear to the right, as shown in Figure 3.6 below: Figure Device Name and Configuration The Name field defines the actual name of the Peripheral as it is understood by Intelli-M Access. Change the name from its default to your liking, and press the 'Create' button. The Peripheral will now be created, and shown as a Peripheral along with Room Mailbox names in the Peripherals page, as shown in Figure 3.7:

21 Figure Created Peripheral 'Exchange Calendar (mailbox)' CREATE RULES Now that you have created a Peripheral that represents the Exchange Server and its Room Mailboxes, you can create Rules that act on Events that will be generated by the Room Mailboxes for meeting notifications. CREATE AN UNLOCK ZONE RULE You can unlock the door of a room associated with an Exchange Room Mailbox by creating an Unlock Zone Rule for that Room Mailbox. From the Intelli-M Access interface, click the Configuration link and then click on the Rules tab. When the Rules page appears, click the 'Create Rule' Action from the Actions menu. A popup dialog will appear, and will show the Access Privilege Rule by default. Open the combo box and select 'Unlock Zone' from the list. The popup dialog will populate with fields for supplying information to configure the unlock zone rule, as shown in Figure 3.8.

22 Figure Create 'Unlock Zone' Rule Dialog Schedule. Choose a Schedule that defines the time range you want to allow this Rule to run (usually the 'Always' Schedule). Ignore the Group, Zone, Door and Reader tabs. Event. Select 'Meeting Reminder' (or 'Meeting Started') Event from the list. Peripheral. Choose the Room Mailbox name associated with the Door that is physically securing that area. Target Zone. Choose the Zone you wish to unlock, which contains the Door that is physically securing the area represented by the Room Mailbox. Click the 'Create' button to create the Rule. CREATE A REVERT ZONE RULE You can re-lock the door of a room associated with an Exchange Room Mailbox by creating a Revert Zone Rule for that Room Mailbox. This will revert the door to its normal lock schedule (which is assumed to be locked). From the Intelli-M Access interface, click the Configuration link and then click on the Rules tab. When the Rules page appears, click the 'Create Rule' Action from the Actions menu as before. Open the combo box and select 'Revert Zone' from the list. The popup dialog will populate with fields for supplying information to configure the Revert Zone Rule, which are the same as the Unlock Zone Rule.

23 Schedule. Choose a Schedule that defines the time range you want to allow this Rule to run (usually the 'Always' Schedule). Ignore the Group, Zone, Door and Reader tabs. Event. Select 'Meeting Ended' from the list. Peripheral. Choose the same Room Mailbox that you specified in the 'Unlock Zone' Rule. Target Zone. Choose the same Zone that you specified in the 'Unlock Zone' Rule.. Click the 'Create' button to create the Rule. Perform these two tasks for each Door that is associated with a Room Mailbox. CREATE A MEETING You have completed the installation and configuration of the Intelli-M Access Exchange integration, and setup your system to manage the Door locks via Microsoft Exchange. You can now use Outlook or other Exchange client to unlock and re-lock the doors by merely creating Meetings or Appointments that include the associated Room Mailbox accounts in the meeting or appointment.

24 CHAPTER 4 - GOOGLE CALENDAR INTEGRATION Intelli-M Access Professional can integrate with Google Calendar to allow Google Calendar Appointments to automatically unlock and re-lock doors controlled by Intelli-M Access. This feature is available for those organizations that do not have Microsoft Exchange deployed at their facility. HOW IT WORKS Intelli-M Access Professional can use Google Calendar integration to send Meeting Reminder, Meeting Started, and Meeting Ended Events to Intelli-M Access for specified Location Names. The integration plugin accomplishes this task by monitoring the Calendar of each specified Exchange Room Mailbox. Therefore, whenever a Meeting or Appointment is scheduled in the Calendar of a Room Mailbox being monitored, the Intelli-M Access Exchange integration will send Events to Intelli-M Access informing it of these Calendar Events. A "Meeting Started" Event will be sent to Intelli-M Access the moment that a meeting is scheduled to begin, and a "Meeting Ended" Event will be sent to Intelli-M Access the moment that a meeting is scheduled to end. If you also requested Exchange to send out Meeting Reminder notifications to the required attendees, the plugin will also send "Meeting Reminder" Events to Intelli-M Access at this time as well. These Events appear in Intelli-M Access no differently than any other Event, and can therefore be configured for use on the Rules page like any other Event. The most common usage for these Events is to unlock and re-lock meeting room or public-access doors. For example, Intelli-M Access can be programmed to unlock a door when Exchange sends the Meeting Reminder or Meeting Start Events, and programmed to re-lock the door (or revert the door schedule) when the Meeting Ended Event occurs. Once you have configured the unlock/revert Rules in Intelli-M Access, all you have to do is create Meetings or Appointments in Outlook to control the meeting room door. GOOGLE CALENDAR INTEGRATION REQUIREMENTS All you need is a valid Google Mail address. INTEGRATION CHECKLIST Google Calendar integration is simpler to configure than the Exchange integration effort, but it also has some limitations. CREATE A PERIPHERAL Login to Intelli-M Access and proceed to the Peripherals Page. Click the 'Create Peripheral' command in the Actions Menu, and a Create Peripheral Dialog will appear, as shown in Figure 4.1:

25 Figure Create Peripheral Dialog Click the New menu to see the available plugins to use as Peripherals, and you should see a menu with one or more menu items, as shown in Figure 4.2: Figure Create New Menu Popup If you do not see Google Calendar' in the popup menu, click the Discover button and wait several seconds for Intelli-M Access to re-discover the plugins, then click the New button again. If you still do not see the Google Calendar menu item, please verify that you are using a licensed Intelli-M Access Professional installation.

26 If the plugin installation proceeded correctly, you will see the Google Calendar entry among the other menu items in the popup menu. Select the 'Google Calendar' menu item to start creating the Peripheral based on this plugin, and a Create New Google Calendar popup dialog will appear, as shown in Figure 4.3, using the fictitious "my " GMail account: Figure New Google Calendar Popup Dialog Username: Provide the username of your Google Mail account, which is typically your GMail address. Password: Provide the password for the user account you entered above. Location Names: Provide the name of each meeting location you plan to specify when creating Appointments in Google Calendar, separating each address with the comma (,) character. Important Note: Google Calendar Location Names are whatever you provide Google Calendar when you create an Appointment in the Google Calendar web page. Therefore, you must be careful to enter the names in Google Calendar exactly as you have entered them in the Location Names box. Any misspellings will be viewed as a different Location. The window will update to show a progress indicator while Intelli-M Access connects to the Google server using the supplied information, as shown in Figure 4.4 below:

27 Figure Google Calendar Progress Popup For each Location Name you specified, the Exchange plugin will send Intelli-M Access three test Events: one for Meeting Reminder, one for Meeting Started, and one for Meeting Ended. The purpose for these test Events is so Intelli-M Access will be informed of the Location names and the Events they will generate. This in turn allows Intelli-M Access to be able to display this information on the Rules page for creating Rules. If one or more pieces of information was entered incorrectly on the Create Peripheral popup, or if there is some other connectivity issue like a firewall blocking the port, the previous configuration page will appear, giving you the ability to adjust the values you entered and try again. Once Intelli-M Access was able to complete the connection, it will display the Device Created window as shown in Figure 4.5.

28 Figure Google Calendar Device Created If you entered the correct server information, the progress will complete and a new entry in the Discovered Devices list will appear, as shown in Figure 4.6: Figure New Exchange Device added to Devices list

29 Click the newly-added Device, and the device's name and configuration will appear to the right, as shown in Figure 4.7 below: Figure Device Name and Configuration The Name field defines the actual name of the Peripheral as it is understood by Intelli-M Access. Change the name from its default to your liking, and press the 'Create' button. The Peripheral will now be created, and shown as a Peripheral along with Location names in the Peripherals page, as shown in Figure 4.8:

30 Figure Created Peripheral 'Google Calendar (my )' CREATE RULES Now that you have created the Peripheral, you can create Rules that use the Peripheral to unlock and re-lock Doors. Please refer to the Rule creation guide in Chapter 3 - Outlook Integration. CREATE AN APPOINTMENT Intelli-M Access is now configured to monitor your Google Mail account's Calendar for Appointments. To create an Appointment in Google Calendar, log into your Google Mail account and click on the 'Calendar' toolbar item. When the Calendar view appears, simply double-click on any time block to create an Appointment. A 'New Appointment' web page will appear, similar to what is shown in Figure 4.9.

31 Figure New Google Calendar Appointment Page Meeting Subject. Provide a subject for the new meeting. This will show up as part of the Event in Intelli-M Access. The other part of the Event will be the Meeting Reminder, Meeting Started and Meeting Ended Events. The example subject in Figure 4.8 is "Important Meeting." Where. Provide the exact name of the Location you specified in the Google Calendar configuration UI. Important Note: If you do not match the name exactly as provided to Intelli-M Access, the Event will appear in Intelli-M Access, but it will be seen as a Location not present in the list, and therefore no Door will be unlocked. Reminders. If you keep the " " Reminder, a "Meeting Reminder" Event will be generated in the timeframe noted in the Calendar. All other items on the page are not relevant to Intelli-M Access, and you can configure them as you please. Once you are finished, press the 'Save' button to create the Appointment.