EasyLobby SVM 10.0 / Kantech EntraPass Integration Setup Guide

Transcription

1 EasyLobby SVM 10.0 / Kantech EntraPass Integration Setup Guide I. System Requirements This version of the EasyLobby / Kantech EntraPass integration has been developed for EasyLobby version 10.0 and Kantech EntraPass version 4 and 5. It has been specifically tested with versions 4.02, 4.03 and 5.01 Corporate Edition. It has not been tested with any other configurations. II. System Installation Overview Installation of the EasyLobby Kantech EntraPass Integration is composed of many steps some of which have to be performed in the correct order. This section outlines these steps in order to provide a general overview. Before you begin Have a security design concept ready defining what groups of visitors will have access to which set of areas. Have a list of facility codes from which the visitor and temporary employee access cards will be assigned. Make sure you have the necessary user permissions to install software applications on the system where the integration will be installed. Make sure you have access to an EntraPass workstation and have proper credentials to either check or modify (if necessary) the EntraPass configuration relating to cards and card access groups. You will also need a set of EntraPass credentials to use with the integration. Make sure you will have access to an EasyLobby SVM station for the final testing phase. During the installation the following steps will be performed: EasyLobby database installation. The EasyLobby database will be installed (unless it already exists). Configuring EntraPass. The integration needs to know about many variables defined in your EntraPass system such as card type, card format, card access group to use, etc. The integration uses this information as a basis to create cards for visitors and temporary cards for employees and to grant the appropriate access privileges to these entities. Integration software package installation. The integration software will need to be installed. A memory resident service enables the integration to perform its work. The package also installs a utility to enable you to configure the integration. Configuring the integration. Using a configuration utility you will configure the integration implementing the security design concept. Installing and starting the integration service. After configuration you will commit the settings by installing and starting the integration service from the configuration utility.

2 Testing the integration. Closely working with an EasyLobby SVM station you will test the integration. If the integration (or EntraPass) needs to be re-configured you will do so using the configuration utility (and/or the EntraPass workstation client). If you need technical assistance along the way, please refer to the end of this document for support contact information. III. Kantech EntraPass Configuration The EasyLobby - EntraPass Integration performs its job by interfacing the EasyLobby visitor management system with the EntraPass system. This is only possible if the integration knows what type of cards to create, which access levels to assign to certain groups of visitors etc. The various parameters that go into the integration configuration are directly based on some of these type IDs and access level IDs etc. In all cases, the EntraPass ID numbers have to be enclosed in parentheses without any additional space, e.g. for the visitor card type, you might specify Visitor (17). The integration only cares about the ID of the card type 17 ; it ignores the word Visitor. There may be occasions throughout the configuration process when you find yourself having to look up a type ID or access level ID in EntraPass workstation. This usually can be done by hovering the mouse pointer over the name of the access level, site, etc. in the EntraPass workstation GUI. After a couple of seconds of hovering the software displays the ID in a Name (ID) format. You should also be familiar with the general configuration process of the EntraPass system as well as the methods to finding where such id values are located and how they re organized under the various tabs. More information about such values is contained in later sections of this document focusing on the configuration utility. The integration requires SmartLink to be installed and registered on the server. You also need to have the SmartLink network connection mode set to Messages and commands. This setting can be found under the Devices tab, EntraPass Application window, SmartLink tab in the EntraPass workstation software. IV. Install the EasyLobby SVM 10.0 Database Server To use this integration, you must install the EasyLobby 10.0 database on MSDE or SQL Server (the integration is not supported on Oracle or local Access databases). If you have already installed the EasyLobby 10.0 database on MSDE or SQL Server, you can skip this section and proceed to the next section below. For complete database setup instructions, please read the database setup documentation found in the SQL folder of your EasyLobby Product CD, EasyLobby MSDE Setup.pdf (for MSDE) or EasyLobby SQL Server Database Setup.pdf (for SQL Server). August 2, 2010 Page 2

3 Once you have installed the EasyLobby 10.0 database, you can proceed with the installation instructions starting with the next section below. V. Install the Integration Solution Your EasyLobby product CD should include a folder called Kantech EntraPass 4 which contains the integration installer. Run the installer program Setup.exe file from this folder. You must install the integration solution on a system with network visibility to the EntraPass server. Otherwise, the EasyLobby database server may reside in any local or remote database server instance (MSDE or SQL Server) which is accessible on the network. The default installation folder for the integration is C:\Program Files\EasyLobby\EasyLobby Kantech EntraPass Integration\. VI. Configure the Integration This solution ships with a utility that helps you configure and install the integration hook into your EasyLobby database. To run this utility, choose the command Start Programs EasyLobby 10.0 Kantech EntraPass Integration EasyLobby - Kantech EntraPass Integration Configuration. The utility has a single screen interface with a small number of tabs as shown in the graphic below. The individual settings are described in the sections following. The Start menu group for the integration also contains links to uninstall the integration solution as well as shortcuts to start and stop the integration service, and also to install and uninstall it. August 2, 2010 Page 3

4 EasyLobby Database Section Upon launching the configuration tool, it populates the Available SQL Servers list with all the discoverable SQL server instances on the network. Refresh List Click this button to re-populate the list of available SQL servers. Available SQL Servers The.NET framework allows automatic discovery of available SQL Servers on your local network. Click on the server instance from the list you would like to use as the database server instance which hosts the EasyLobby database. If you don t see the server which hosts the EasyLobby database on the list it is because the server is either inaccessible or has been configured to be hidden from automatic discovery. If the latter is the case you need to type the instance name in the SQL Server Instance textbox. August 2, 2010 Page 4

5 SQL Server Instance Specifies the SQL Server instance in which the EasyLobby database has been installed. This takes the form of COMPUTER_NAME\INSTANCE_NAME, or in the case of a default instance it is simply COMPUTER_NAME. If you need to specify a custom port, you may enter it after the instance name followed by a comma, e.g. SERVER\EASYLOBBY,1434 or SQLSERVER01,9876. Authentication type Specify the type of authentication you wish to use. By default, EasyLobby database uses SQL authentication with user easyuser10 and password door10man+. If you change this credential set at the time of installing the database, you need to specify the alternate credentials here. If you use NT authentication, please make sure that the account you specify in the Service Credentials section is part of the SQL Server s security schema and has the db_owner property set for the EasyLobby database. If you specify Local System as the service user and also using a remote SQL Server with NT authentication type, the integration may not be able authenticate correctly. For more information on how the various built-in NT user accounts authenticate with SQL Server when using NT Authentication authentication type, please refer to the corresponding documentation from Microsoft. User Name Specify the username to use with SQL Server authentication type ( easyuser10 by default). Password Specify the password to use with SQL Server authentication type ( door10man+ by default). Database Specify the name of the EasyLobby database ( EasyLobby10 by default). Service Credentials You must supply the credentials to a Windows account that is used to run the EasyLobby Kantech Integration Service service. This can be a local or domain administrator account or the default Local System built-in NT account. If the EasyLobby database server is running on a different system than the integration, special care must be taken when using built-in NT accounts with NT authentication (see EasyLobby Database section). Please note that the account you specify must have Log on as a service permission. See section VIII for specific details for setting this permission. Computer or Domain Enter the name of the local system if running the service with a local user account. Enter the name of the Domain if using a domain account. User Name Enter the account name of a local or domain account. In addition to the rights specified in the previous paragraph this account must have read and write access to/from the installation folder in order to be able to read and save configuration settings into the Settings.xml file. Password Enter the password for the Windows account specified. August 2, 2010 Page 5

6 Integration Options Service GUID Each instance of the integration has a unique identifier in the EasyLobby database. This ensures that two instances of the integration installed on separate computers (for the purposes of controlling separate sites, for instance) can coexist in the same EasyLobby database. You may either enter a GUID to identify this installation of the integration or you can let the utility generate one for you by clicking the Generate New button. Record Processing Interval Determines how often the integration service wakes to check for new visitor activity from EasyLobby. If there has been visitor check in, check out or delete activity, an appropriate action is taken to implement the corresponding change in EntraPass based on the integration settings described in the rest of this document. Retain Error Messages For The integration notifies the EasyLobby SVM stations of cardholder creation failures and also delivers other important system messages back to the EasyLobby operators. These messages can be essential to aid in troubleshooting at a later time. The recommended setting is to keep record of error messages for a minimum of 6 months. Fractional values are allowed. A value of 0 will cause the integration never to delete error messages. EasyLobby SVM stations have to be explicitly configured to receive integration error messages. To enable integration error reporting log onto an EasyLobby SVM or Administrator station with an EasyLobby administrator account. Open Program Options from the Edit menu. In Defaults tab, General tab, check the checkbox Enable access control integration error reporting. You may also set how often the EasyLobby station should check for the availability of messages originating from the integration process needing to be reported to the operator. Setting a low time period (5 seconds or less, for most situations) can ensure that the operator gets informed about any cardholder creation errors in a timely fashion. This gives the operator the opportunity to take corrective action before the visitor leaves the check-in station. Retain Unprocessed Transactions For If the integration has to be stopped or disabled for any reason the database will still continue to accumulate requests from EasyLobby SVM client stations regarding visitor check-in, checkout and delete operations (unless the integration is uninstalled). As soon as the integration is re-enabled these operations will be processed all at once in the same order they were created originally. It is generally assumed that when an operator attempts to assign a card to a visitor the immediate activation of such a card is desired. It is further assumed that if the integration is disabled and cannot activate the card in EntraPass right away then that transaction is meaningless for the future and should not be persisted in the integration s processing queue. On the other hand, in most situations it is desirable to retain unprocessed requests for disabling and/or deleting visitor cards unless this has been done manually while the integration is in a disabled state. Also, you may specify the Set Cards to Delete On Expired option in which case EasyLobby-made August 2, 2010 Page 6

7 visitor cards will never get stuck in the EntraPass system. A value of 0 disables the automatic purging of unprocessed transactions. Retain Verbose Log Messages For Verbose logging is one of the best ways to troubleshoot problems with the integration. When verbose logging is enabled the integration will generate multiple kilobytes worth of messages in the database for every transaction. If these messages are left to accumulate without being checked the verbose log can grow to such a large size in the database that it may ultimately cause performance slowdowns. Keeping only the last hour s worth of such messages should be sufficient for most troubleshooting scenarios while also reducing the burden of log accumulation on the database. A value of 0 forces the log messages to be retained forever. Troubleshooting Enable Verbose Logging If you observe that the integration is not working as desired it may prove helpful to enable the verbose logging option of the integration. A log table in the EasyLobby database is used for the purpose of logging messages generated by the integration. When verbose logging is enabled many status messages about the integration s execution in general are logged. Error messages are always logged regardless of the verbose logging setting. Warning: verbose logging can easily create hundreds of thousands of log messages in a couple of days, which can clutter the database and potentially introduce performance issues. Please make sure that if you decide to enable verbose logging you only do so for the time of troubleshooting a problem and then promptly disable it once troubleshooting is done and/or use a short time period setting for retaining verbose log messages. View All Logs Launches a log monitor window which displays verbose log messages as well as errors. Integration Status monitor Displays the current status of the integration database hook and also validates the database connection. If the configuration utility is unable to connect to the EasyLobby database an error message is displayed. As soon as all the database settings are entered correctly the status reads Not installed, Enabled or Disabled. Integration Enable/Disable button This button allows you to temporarily suspend the integration s operation (perhaps for troubleshooting reasons) through a setting in the database. Pressing this button does not affect the integration service in any way. When the integration is disabled this way, records still accumulate in the integration transaction tables (according to retention settings), but are not processed until the database hook is re-enabled. This button is disabled when the integration hook cannot be detected in the database specified in the EasyLobby Database section. If you do not wish to have the accumulated records processed when the integration is re-enabled you need to adjust the transaction retention settings or run the following SQL command against the SQL database: August 2, 2010 Page 7

8 DELETE FROM IntegrationTransactionStatus WHERE IntegrationUid = '<integration GUID>' AND ProcessedDate IS NULL Please make sure to substitute <integration GUID> part in the expression above with the GUID found under the Service GUID section. Utility Buttons Help Displays the help file. Defaults Resets all the settings on the current form to the factory settings. Note that these settings will not be saved unless you click the "Save Settings" button. Save Settings Saves all the current settings to the Settings.xml file located in the installation folder. Use this file if you need to migrate settings between two installations. (It is also recommended to create a backup of the settings file to aid in cases of server crash recovery. To restore saved settings, simply place the backup copy of the Settings.xml file into the installation folder allowing it to overwrite any existing Settings.xml file.) Remove Removes the integration from the EasyLobby database and stops and uninstalls the EasyLobby Kantech Integration Service service. Also removes the integration hook from the EasyLobby database. Install Saves the current settings and installs the integration hook into the EasyLobby database. It also installs and starts the EasyLobby Kantech Integration Service on the local system. Exit Quits the configuration application. August 2, 2010 Page 8

9 EntraPass Settings Tab Kantech Server IP Address Specify the IP address of the server where Kantech EntraPass is installed. Kantech SmartLink Tag A numeric value which uniquely identifies the integration to the EntraPass server. When choosing this number, please make sure that no other SmartLink client is using this value. The SmartDll API connects to the EntraPass server with this network tag number. Test Connection button An attempt to connect to the EntraPass server is made. Please note that a successful connection does not validate the username and password, only the IP address. August 2, 2010 Page 9

10 Kantech Username Specify a valid login id to the Kantech server. Please make sure this user has privileges sufficient enough to be able to create cards, assign access levels etc. such as an administrator account. You may need to enable Concurrent logins in the Security tab of this operator s account in EntraPass, especially if you use an all-purpose administrative account for the integration. Kantech Password Specify the password for the login id specified in the previous text field. Badge Type Controls what type of visitor badges are used with the integration. Set to Proximity cards if you are issuing proximity cards for your visitors. This setting applies in all proximity card situations regardless of whether you recycle the same proximity cards for different visitors or let the visitors keep the cards after their visit. The integration uses the Prox Card field from the Badge tab on the EasyLobby visitor form as the card number to send to EntraPass. We recommend using a USB proximity card reader with EasyLobby to eliminate human error when entering the prox card number. Such readers are available for purchase from EasyLobby. When configuring the USB proximity card reader, make sure to configure the resulting card number read to be output in a format identical to what is specified in EntraPass Options tab, Card Format window. There are other ways to enforce the EntraPass card format; however this option is the most reliable. The Barcoded Badges setting sends the Custom ID field from the Badge tab on the EasyLobby visitor form as the card number to EntraPass. This is the alphanumeric ID that gets encoded and printed as the barcode on paper badges from EasyLobby SVM. By default EasyLobby automatically generates custom IDs which begin with a letter ( V for visitors, E for employees etc.). EntraPass is unable to recognize these alphanumeric IDs as card numbers, therefore one must override the default Custom ID generation setting in EasyLobby and change it to numeric-only custom ID generation by removing the letter prefix of the custom ID formula. This can be done in EasyLobby SVM or Administrator in Edit menu Program Options Defaults tab Custom Id tab. You might also need to use one of the facility code prepend option to make sure the resulting card number is output in the specified EntraPass card format. Send Photo When enabled, the integration sends the visitor s face photo to EntraPass. The sent photo is always the one appearing in the first visitor photo slots in EasyLobby visitor form (regardless of its actual content). Set Cards to Delete on Expired When enabled, the integration sets the Delete on Expired flag for every visitor and temporary employee card created. This is an excellent way to prevent the EntraPass system accumulating expired visitor records even if the visitor forgets to properly check out of EasyLobby. (Please note that if an employee s permanent card has been disabled due to a temporary employee card assignment, that permanent card will not be re-enabled if the EntraPass system automatically deletes the expired temporary employee card.) August 2, 2010 Page 10

11 Enhanced User Management Is Enabled Enable this checkbox when EntraPass is working in Enhanced User Management mode. When enabled, the integration will put the visitor card into the first card slot. When using the temporary employee card feature, the employee s permanent card is set to invalid status on check-in and all of the employee s access levels are assigned to the temporary employee card. In Enhanced User Management mode, only the first card for the employee gets to be disabled temporarily upon check-in. In either case, the card (or the card in the first slot) is re-enabled once the employee checks out with the temporary card (and likely surrenders the temporary card to the gate attendant). Delete Behavior This setting determines how EntraPass handles retention of visitor cards created via the integration with EasyLobby. There are three options: Never Cards are never deleted from EntraPass. On EasyLobby check out or delete the badges are disabled: the card s status is set to Invalid. On Visitor Delete Deletes a card only when the visitor is deleted from EasyLobby and disables the visitor card on EasyLobby check-out. On Check-out and Visitor Delete Deletes cards from EntraPass on both EasyLobby check out and delete events. Card Access Group Mapping Specifies the mapping rule based on which the visitor s Card Access Group(s) are assigned (not to be confused with access level group!). The numeric id of the card access group must be specified here which must be in parentheses. The following value resolution options are available: Default: Assigns the Card Access Group entered in the next textbox ( Default ) to every EntraPass card holder created without differentiation. When this option is selected you can use the Select button to select the access level from a list retrieved from the live EntraPass system. The prerequisite of this function to work is to have specified the EntraPass API connection settings correctly. Visitor Category: Uses the Visitor s Category name as the name (id) of the Card Access Group in EntraPass to assign to the visitor. If the Category value of the visitor does not contain the id of a Card Access Group defined in EntraPass, the card holder is not created. This is a good way to selectively control which categories of visitors to give card access to and which do not. Visitor Clearance: Uses the Visitor s Clearance s name as the name (id) of the Card Access Group in EntraPass to assign to the visitor. If the Clearance value of the visitor does not contain the id of a Card Access Group defined in EntraPass, the card holder is not created. This is a good way to selectively control how visitors with certain clearances have access to doors, elevators, etc. while others do not. Visitor Company: Uses the Visitor s company name as the name (id) of the Card Access Group in EntraPass to assign to the visitor. If the company name of the does not contain the id of a Card Access Group defined in EntraPass, the card holder is not created. This is a good way to selectively control how visitors from certain companies August 2, 2010 Page 11

12 have access to doors, elevators, etc. while visitors belonging to other companies do not. Visitor User Defined #: Uses the value in a visitor s user defined field to resolve the Card Access Group name (id). Employee s Site/Category/Department/Company/Floor/Building: This option resolves the visitor s Card Access Group id based on an EasyLobby data field belonging to the employee the visitor is coming to visit. Employee s User Defined #: Uses the value in that employee s user defined field to resolve the Card Access Group id which the visitor is coming to visit. Card Access Group Default Used only if the previous setting is set to the Default value, otherwise ignored. All visitors are assigned the Card Access Group id which is entered in this textbox in parentheses. Facility Code Mapping The integration uses the rule specified here to assign the facility code or card facility code to the visitor created in EntraPass. The facility code must be specified in decimal (base 10) numeric format. The number resulting from the mapping rule is then converted to hexadecimal or octal format, if warranted by the card format. The possible settings are: do not automatically prepend facility code to card number: When this setting is selected the integration will not try to add a prefix section of the facility code to the card number, but rather it will use the card number value specified through EasyLobby as is (proximity card number or custom id). If Force Specified Card Format is checked, the integration will pad (or truncate) the sections of the card number it receives from EasyLobby to match the format specified (if necessary). If the EasyLobby card number value and the card format do not have the same number of sections, no visitor card is created. All card number sections must be specified in decimal numeric format in EasyLobby the individual sections are converted to hexadecimal or octal format (or left alone) based on the format specifier. The colon character ( : ) always divides any 2 sections. Default: Assigns the number entered in the next textbox ( Facility Code Default ) to the EntraPass visitor as the facility code. The facility code must be specified in decimal numeric format which is converted to hexadecimal or octal format (if applicable) depending on the format specifier. First 3 Digits of Card Number: Uses the first 3 digits of the EasyLobby card number as the card s facility code. When using this option we recommend using a USB proximity card reader with EasyLobby to eliminate human error when entering the prox card numbers. (The devices are available for purchase from EasyLobby.) These products can be configured to read the card numbers in the format where the first 3 digits output is always the facility code and the last 5 digits always contain the card number, for instance. Since the card number sections are truncated by cutting off extra digits on the left, if the card number came out to 8 digits, but the format only specified 5, the integration would produce something like ###:##### for the card number as long as Force Specified Card Format option is checked (and the card format was also like the sample pattern). August 2, 2010 Page 12

13 Station s Site Id: The facility code is based on the EasyLobby [numeric] site id as defined by each EasyLobby SVM station s station enrollment. Visitor User Defined #: The facility code contained in one of the visitor s user defined fields is used as the card facility code. Please note that any user defined field can be made into a drop-down and/or required field in order to minimize operator error and to ease value selection. Employee s Site Id: This option resolves the visitor s card facility code to the site id of the employee they are coming to visit. Employee s User Defined #: This option selects the visitor s card facility code from one of the user defined fields of the employee they are coming to visit. Facility Code Default Contains the value of the default card facility code (a.k.a. card batch) when the previous setting is set to Default ; the value is ignored otherwise. The facility code must be specified in decimal numeric format which is converted to hexadecimal or octal format (if applicable) depending on the format specifier. Card Format Contains the card format as defined in EntraPass. If Enhanced User Management is enabled, the format of the first card is relevant. Valid characters are O, D, H and : (e.g. HH:DDDDD ). Force Specified Card Format Enabling this checkbox will make the integration examine all card numbers generated by the facility code mapping rule and format them to the card number format specified padding the sections with zeros or cutting off the extra digits on the left, if necessary. As a general rule, the number of sections in the resulting card number must match the number of sections in the card format in order for any reformatting to take place. If this is not the case, the check-in or check-out request is not processed (i.e. the card will not be created). The sections in the card number must be specified in decimal numbers and they re converted internally to other formats (octal or hexadecimal) if necessary. Enabling this checkbox can greatly reduce the number of card-not-created type errors which span from formatting issues under certain circumstances (namely, when the number of sections is consistently correct in the card numbers). Pin Code Assignment Rule Controls PIN generation behavior of the integration. Use System Default (00000) sets the pin to all zeros. The Badge Number option sends the last 5 digits of the last section of the card number (without facility code). The Default option lets you manually specify what PIN code to set for all of the cards. Pin Code Default - If the Pin Code Assignment Rule is set to Default, the integration will use this value as the PIN to assign to the card in EntraPass. In the absence of a valid number, 0 is used. Visitor Card Type Specifies the id of the card type the integration should use to create cards for visitors. The numeric id must be enclosed in parentheses. August 2, 2010 Page 13

14 Employee Card Type Specifies the id of the card type the integration should use to create temporary employee cards. The numeric id must be enclosed in parentheses. Employees Visitor Category When filled out, the integration allows assigning temporary access cards to employees who have forgotten to bring their permanent badges. When a visitor is created, EasyLobby examines which visitor category they belong to and for those visitors whose Category matches that which is in the Employees Visitor Category field here (typically Employee ) the integration will attempt to locate the employee record in EntraPass and create a temporary card for that employee, granting that card the same access rights as the employee s permanent card(s). Furthermore, the employee s permanent card is marked invalid until the visitor returns the temporary card (check-out or delete). Upon checkout, the permanent card is re-enabled. In Enhanced User Management mode only the first permanent card of the employee gets disabled and re-enabled in such way. Employee Id Field Temporary employee card assignment works best when the employee who accidentally left their card at home (or lost it) can be unambiguously identified every single time. This is only possible when a unique identifier, the internal employee id is stored both in EntraPass and EasyLobby. EasyLobby s EmployeeImport utility helps you automate the periodic import of employees into EasyLobby. When setting this up, please make sure that the unique employee id data field is mapped to EasyLobby s employee id field. This will take care of having the employee id in EasyLobby which can aid the operator of EasyLobby SVM in finding it easily. From the drop-down, select which card information field contains the same exact employee ids which are imported into EasyLobby through EmployeeImport. If the employee id is not stored in EntraPass at all, the integration attempts to find the employee based on matching their name in EntraPass on check-in. If a name search successfully finds the employee and only one such named employee, only then the temporary employee card creation proceeds. Data Fields Mapping EntraPass allows up to 10 customizable information fields to be populated for each cardholder. In most visitor management scenarios some form of identification or business card is scanned to alleviate the mundane and error-prone task of manually having to type in names, addresses etc. All the data which is captured in EasyLobby can be propagated to EntraPass by mapping EasyLobby s data fields to EntraPass card information slots. Available fields include visitor data as well as information about the employee the visitor is coming to visit. Card information slot #10 is reserved to contain a unique identifier, which helps EasyLobby to identify that a certain card was created by the integration. August 2, 2010 Page 14

15 VII. Start and Test the Integration When you have completed configuring the integration you must click Install to install and start the integration service. You may exit the configuration utility after the utility displays a message confirming that the service installation is completed successfully. Testing the integration involves creating visitor records using appropriate values based on the card access group mapping selection and also by populating the proximity card number or custom ID field in the Badge tab on the visitor record in EasyLobby SVM. E.g. if the Card Access Group Mapping is set to Category and you have an card access group called Building A Visitor set up in EntraPass with the id of 509, you would select Building A Visitor (509) from the Category drop-down in the visitor form in EasyLobby SVM then switch to the Badge tab and enter a proximity card number in the Prox Card field (unless barcoded badges are being used). Once the visitor is checked in, the new card should appear in EntraPass with the appropriate visitor information and access group assigned and the card set to a valid status. On checkout or delete (depending on the configuration) one should observe the card of the visitor in EntraPass switching to an invalid status (for check-outs) or disappearing from the list of cards (for deletes). VIII. Service Log on Permission to the Integration Service Account You must ensure that the account that you specify to run the EasyLobby Kantech Service service has Log on as a service permission in Windows security settings. Run the Control Panel, open Administrative Tools and then open Local Security Policy. In the Local Security Settings window, open the Local Policies folder and select the User Rights Assignment folder as shown in the graphic below. Right-click on the Log on as a service icon and choose Properties. Click the Add User or Group button and enter the user or group that you want to use to run the EasyLobby Integration service. In this example we are using the local user account called EasyLobbyUser. Click OK to add the user or group. August 2, 2010 Page 15

16 IX. Important Usage Notes Updates to visitor data for an already checked in visitor (e.g. name, photo, card number, etc.) will NOT be automatically propagated from EasyLobby to EntraPass. No update to such information is sent over after the initial check-in without an intervening check-out. In other words, to avoid this limitation the EasyLobby operator must check the visitor out of EasyLobby first and then perform the visitor data update on the visitor record, and then check the visitor back in. This will ensure that the visitor data changes propagate to EntraPass appropriately. (The only exception to this rule is when proximity cards are used, and the Prox Card field is updated from having no value to having a value.) The check out operation will disable the card briefly for the time of the data update, but then the consecutive check in operation will re-enable it right away. The integration service is designed to wake every 5 seconds (by default) and check for EasyLobby visitors needing to be processed. It is possible that a proximity card or printed badge may take a few seconds (depending on network bandwidth and other factors) before becoming activated in EntraPass and hence the visitor may experience a few seconds of delay after check-in in EasyLobby to successfully being able to access doors or other EntraPass controlled resources. If one suspects that the cardholder creation failed one should check the integration log for details through the configuration utility. August 2, 2010 Page 16

17 X. Setting up EmployeeImport The integration solution will create cardholders in EntraPass. The integration can also allow assignments of temporary access cards to employees in case they forgot (or lost) their permanent card. It is recommended that an EmployeeImport process is set up to run once a day (preferably overnight) in order to keep the list of employees who can receive visitors up to date in the EasyLobby system. For complete instructions on how to set up EmployeeImport, please refer to the chapter titled Importing Employee Data in the main EasyLobby manual located on the installation CD-ROM. If EntraPass is used as the source of the employee data, please make sure to filter out all records where Card Information field #10 contains EASYLOBBY_### where ### can be a number of any length. These would be the cards created by EasyLobby. If you forget to take this precaution, the EasyLobby visitors will be re-imported back into EasyLobby as employees. If the data source for EmployeeImport is not EntraPass but another system (perhaps one used by HR) then care should be taken to put the same Employee IDs into EasyLobby which go into EntraPass. Please make sure to map the employee id to EasyLobby s EmployeeNumber field. Again, this serves in aiding the user of EasyLobby SVM in its ability to assign a temporary card to the correct employee in EntraPass. When an employee arrives at the front desk and requests a temporary access card from the EasyLobby SVM operator, the operator creates a regular visitor record for the person but then selects the special visitor category designated for employees ( Employee by default). The EntraPass employee ID (if known) should then be entered into the ID Number field on the Contact tab of the visitor form. To find out the employee ID, the operator can try to locate the employee in EasyLobby s employee section. This can be done by using one of the many employee lookup features of SVM or by simply double-clicking the employee s record in the employee grid view. Looking up the employee s EntraPass employee ID number through EasyLobby s employee section is what makes the proper setup of EmployeeImport process important. Back in the visitor form, the Prox Card field needs to be populated with the temporary card number (or the Custom Id field in case of barcoded badge use). Then the employee is to be checked in by clicking the Check In or Print Badge buttons similarly to any other visitor. This act triggers the integration and the assignment of the temporary card in EntraPass. The internal lookup of the employee in EntraPass is based on the EntraPass Employee ID which should have been entered into the ID Number field of the visitor form ( SSN DB field). If the EasyLobby SSN number/id number resolution to the EntraPass Employee ID fails for any reason, as a fallback measure, the lookup of the employee in EntraPass is attempted by matching the first and last names. If there is more than one person with the given first and last name combination in EntraPass then the resolution is considered ambiguous and an error message will tell the operator that the card could not be created. August 2, 2010 Page 17

18 (Note: by default, the ID Number field is hidden in the employee detail view in EasyLobby SVM. To un-hide this field, go to Edit menu, Program Options, Customize Fields tab, Visitor Form tab and uncheck the Hide SSN field on visitor and employee form checkbox.) XI. Additional XML Based Setting The configuration utility saves all the settings to the Settings.xml XML file located in the installation folder. Use this file if you need to migrate settings between two installations. (It is also recommended to create a backup of the settings file to aid in cases of server crash recovery. To restore saved settings, simply place the backup copy of the Settings.xml file into the installation folder allowing it to overwrite any existing Settings.xml file.) There might be one or more settings which can only be modified through editing the Settings.xml file manually. You can edit an XML file using any plain-text editor like Notepad or the free XML Notepad tool from Microsoft. The following section lists these variables and the function they serve. This section is for advanced users only. In most installation scenarios will not need to modify these settings. Name Description Default Value EasyLobbyInitialServiceTimerDelay Sets the amount of time in seconds the 60 integration service waits after receiving the start command from the operating system and before the first call is made to EntraPass in order to process integration records or to populate clearances back to the EasyLobby database. This setting may be useful when use for forcing the operating system to adhere to a proper booting sequence of EntraPass first and then the integration. KantechVer402Fix When set to true the integration suppresses setting the following badge properties: PRIVILEDGEOPERATION DISABLEPASSBACK EXTENDEDDELAY WAITINGFORAPPROVAL BADGING CARDFILTER ACCESSLEVEL You must set this variable to true in some installation scenarios, specifically when using version false August 2, 2010 Page 18

19 XII. Operation of the Solution The EasyLobby EntraPass integration solution utilizes SQL triggers in the EasyLobby10 database and a Windows service called EasyLobby Kantech Integration Service. This service is installed and started by the Install function of the configuration utility. The service and its status can also be seen in the Services control panel applet. When a visitor is checked in using EasyLobby SVM, a trigger in the EasyLobby10 database is executed which inserts a record in the IntegrationTransactionStatus table in the EasyLobby10 database. The EasyLobby EntraPass Integration service checks this table every 5 seconds (by default) and processes any new records found. The service then creates the visitor person (only for visitor check-ins) and card entities, assigns the appropriate access level to the card in EntraPass through the API. The internal EasyLobby Visitor ID is populated into the card information #10 field of the new card. The presence of this moniker in any card record signals the integration that the visitor was created by the integration and not by someone else. If the card is determined not having been created by EasyLobby, the integration does not operate on that card. The configuration utility stores its settings in the Settings.xml file. The card number is taken from the Prox Card No. field if using prox cards for the integration, or from the Custom Id field if using barcoded badges. The Valid From and Valid To time specified for the visitor is transferred to EntraPass as the card s activation and expiration dates. The prox card or barcode will only be valid between these dates/times. (Please note that EntraPass does not enforce times of activation/expiration only dates.) When a visitor is checked out or deleted from EasyLobby SVM, the trigger is executed and it inserts an operation record in the IntegrationTransactionStatus table. The EasyLobby EntraPass Integration Service checks this table every 5 seconds and removes (or disables, depending on the configuration) the record in EntraPass. Disabling of a badge is defined as setting its status to invalid. During normal operation of the EasyLobby Kantech Integration Service service, notifications of any severe errors that might occur are displayed to the end-user and are also logged to the IntegrationLog table with reference to which station s operation generated the error message. Log and error messages are automatically purged based on their age. The message retention policy can be adjusted through the integration configuration utility. To troubleshoot the EasyLobby Kantech Integration Service service, you can run the configuration application and check the Enable Verbose Logging option. For this change to take effect you do not need to remove and reinstall the service, only need to save the settings. The change should take effect the next time the service wakes up (5 seconds by default). Verbose log messages resulting from enabling this option are written to the log table. Warning: make sure to disable verbose logging once troubleshooting is completed, for this mode of operation can burden the database with many unnecessary messages. You can use the configuration utility s log viewer window for deleting old log messages. August 2, 2010 Page 19

20 We have also provided four batch files that can be used to install, start, stop and uninstall the EasyLobby Kantech Integration Service service. These are called install.bat, start.bat, stop.bat and uninstall.bat, respectively. XIII. Technical Support For more information or support on this solution, please contact EasyLobby, an HID Global business at or through the support portal at or at August 2, 2010 Page 20