Release 2.10 Personnel Module Guide November 2016
SATEON Release 3.0 Personnel Module Guide Issue 0.1, released November 2016 Disclaimer Copyright 2016, Grosvenor Technology. All rights reserved. SATEON and the SATEON logo are trademarks or registered trademarks of Grosvenor Technology. All other brands, names, or trademarks appearing in this document are acknowledged as the trademarks of their respective owners. No part of this document may be reproduced in any form or by any means for any purpose without the written permission of Grosvenor Technology. Whilst we make every effort to ensure the accuracy of our publications, Grosvenor Technology assumes no responsibility or liability for any errors or inaccuracies that may appear in this document. www.grosvenortechnology.com Sateon Release 3.0 2 Issue 0.1
Contents Preface...5 About Sateon... 5 About this guide... 5 Related documents... 6 Technical support... 6 Introduction...7 About the Personnel module... 8 About personnel records... 9 About token records... 9 Managing personnel records... 11 Setting up a new personnel record...12 Creating a new person record from scratch...12 Creating a new personnel record based on an existing person...16 Searching for a person...18 Defining the personnel fields that are included in the search...18 Running an advanced search...20 Managing a person s photos...22 Capturing a photo from a webcam...23 Uploading an existing photo from file...25 Changing the size of a person s photo...26 Setting a default picture...27 Deleting an existing photo...28 Exporting a photo...29 Managing a person s access...29 Viewing and defining access from the Personnel page...30 Granting access to a person from the Access Group page...31 Issuing tokens to a person...33 Issuing a permanent token...33 Sateon Release 3.0 3 Issue 0.1
Issuing a temporary token...35 Using temporary token workflow...37 Revoking a token...39 Managing a person s tokens...41 Checking a person s tokens...41 Creating a new token from the personnel page...44 Dealing with a lost token...46 Managing misused tokens...47 Managing tokens... 49 Setting up supporting data...50 Setting up a new token type...50 Setting up a new token pool...52 Setting up a new token status...53 Setting up new token records...54 Creating a single token...54 Creating a batch of tokens...57 Issuing and revoking tokens from the Token page...59 Issuing a token from the Token page...59 Revoking a token from the Token page...60 Viewing details of tokens...61 Viewing details of token status...61 Viewing token history...62 Printing a token...63 To print a token from the Personnel page...64 To print a token from the Token page...65 Sateon Release 3.0 4 Issue 0.1
Preface This document provides information on the Personnel module of Sateon, which enables you to set up the personnel in your organisation and the tokens they use to gain access and the access they are permitted. This version of the document relates to Sateon Release 3.0. Date of latest update: November 2016. About Sateon Sateon Advance is a powerful yet easy-to-use browser-based access control system that allows users to manage and monitor physical access to sites. It integrates access control, alarm and incident monitoring, visitor management and reporting facilities. Based around a set of SQL databases, it allows system managers and security staff in any location to set up, view and monitor data about personnel, access cards/tokens, the system hardware, access permissions and reported events. Sateon is installed on a central server, and can then be accessed from any location via a browser-based interface. About this guide This document describes how to manage data in the Personnel module of Sateon Advance which includes setting up the people who will use the system and the tokens they use to gain access to the site. Note: This document is primarily intended for users of the Expert Mode, who have access to all features of Sateon. Users of the Quick mode will see a simplified interface and will not have access to all the features It includes the following information: Sateon Release 3.0 5 Issue 0.1
Section 1 Introduction. This section provides an overview of the personnel module and its capabilities. Section 2 Managing personnel. This section explains how to set up and maintain personnel records, including defining access, issuing tokens and including photos. Section 3 Managing tokens. This section includes details of setting up new token records, issuing and revoking tokens, managing lost and misused tokens and printing tokens. Note: Representations of screens in this document are shown for general illustration only. There may be some differences in the screens you see, depending on the operating system and the computer configuration. Related documents The following documents, available from Grosvenor Technology, may also be useful: The Sateon Beginner s Guide. This provides an overview of some of Sateon Advance s key concepts and functions, including the use of tokens, event handling and reporting, security features, notifications and language support. It is aimed at new users and does not assume any previous knowledge of access control systems. The Sateon Access Control Guide. Explains how to set up the data in the access control module of Sateon Advance which includes access permissions, time patterns, areas and system hardware. The Sateon Control Centre Guide. Explains the Sateon Control Centre, which allows security staff to view and monitor events, to deal with reported incidents and to manage or control specific elements of the system. The Sateon Event Configuration Guide. Details how to set up the way in which system events are reported, tagged and used within the system. The Sateon System Administration Guide. Explains how to configure a number of functions for system management and administration. There are also a number of guides to optional features of Sateon including interfaces to third-party systems such as fire panels and CCTV systems. Technical support For further assistance with Sateon Advance, please contact Grosvenor Technology Technical Support as follows: Email (EMEA): ac-support@grosvenortechnology.com Telephone: +44 (0)1279 838000 Website: www.grosvenortechnology.com Sateon Release 3.0 6 Issue 0.1
Section 1 Introduction This section provides a general introduction to the Personnel module within of Sateon. For information on the module capabilities, see About the Personnel module on page 8. For overview information about Personnel data, see About personnel records on page 9. For overview information about Token data, see About token records on page 9. Sateon Release 3.0 7 Issue 0.1
About the Personnel module The Personnel module in Sateon allows you to set up and maintain details of the people who will access your site, and the tokens they will use to gain entry. It enables security staff to: Set up and maintain details of people that can access the site. Set up and maintain details of the tokens that people use at readers and doors. Issue permanent and temporary tokens to people as required. Manage missing and misused tokens. Print tokens at specific printers. To access this module, choose the Personnel option from the module buttons that appear at the top of each screen. The Personnel Management page appears: The various options you can select appear in the pane on the left. Sateon Release 3.0 8 Issue 0.1
About personnel records Within Sateon, personnel are the people whose details are held on the system for the purposes of access control for example, employees, associates and contractors. Personnel should not be confused with system users which is the term used for people who can log in and use the Sateon application, such as system administrators or security staff. Personnel normally hold access tokens, but this is not a system requirement as you may wish to hold personal information about other people, such as ex-employees or contractors. Once a person has been set up you can define the access that is allowed the readers at which the person s tokens are valid. This identifies the buildings, locations and areas that the person can access. You can add photos to a personnel record, both as a security measure and to help staff quickly and easily identify people. These photos can be printed on the person s token if required. If required, the person can be assigned to a department. This is an optional feature but can be useful for grouping and searching larger organisations. Certain access control attributes can be assigned to personnel, for example you can specify that an individual is a wheelchair user or has sight loss. These features are not used by the main Sateon system but may be used by optional third-party integrations: for example elevator integrations can enable doors to be kept open longer for wheelchair users. Note: In some countries you may be required to register under a data protection act if you hold personal data. About token records Within Sateon, a token is any object which a person can make use of to gain access to particular sites, buildings or areas within your organisation. This can be anything that can be scanned by some kind of reader such as a card of some type or a proximity device. You can set up the specific types of tokens that you use in your organisation. Each physical token must have a record within Sateon. An individual person can hold multiple tokens, and may use different tokens for access to different areas. Each token has a status: for a token to permit access to a reader, it must have a status of Enabled. Additional statuses can be set up for your convenience, but they will not permit access. Tokens are organised into token pools groupings of tokens with similar characteristics. For example, you could have a pool of permanent tokens, and a pool of temporary tokens that you give out to people who have lost their permanent token. Sateon Release 3.0 9 Issue 0.1
Note: By default the system includes two token pools (Permanent and Visitor), but you can create additional pools if you need to. For a token to permit access at a reader, the following conditions must be met The token must have a status of Enabled. The token must be assigned to a person. The person must have the correct access rights. The time of the token read must be within the token s valid date/time range. The time of the token read must be within the person s valid access date/time range. The time of the token read must be within the access group s valid date/time range. The token must not be suspended. If a token has a status of Enabled but is issued to a person before its Valid From date, it is marked as Pending. If a token has a status of Enabled but its validity period has expired, it is marked as Expired. Some organisations may require personnel to enter a PIN at a keypad in addition to their token being read in order to gain access. In this case you can set up a PIN for a token. If a person forgets their normal token, you can issue a temporary one. If you wish, you can set this to only be valid for a limited time. You can also mark the original token as Lost or Stolen, which will remove all access rights from the token. In some cases, a token can be automatically suspended by the system. For example, if a token is used repeatedly to attempt access to an area where the person does not have permissions, if access is attempted outside a valid time schedule, or if a PIN is incorrectly entered multiple times. It is also possible to suspend a token manually, for example if you suspect misuse. A system user with administrator rights will need to reset a suspended token. Some installations support the printing of tokens. Some default card designs are included in Sateon; these can be amended or new ones created but this is done outside Sateon. They can contain personal data from the Sateon database such as name, employee number and department as well as photos. They can also include standard text and graphics such as company names and logos. Sateon Release 3.0 10 Issue 0.1
Section 2 Managing personnel records This section explains how to set up and manage personnel records within Sateon. It includes the following: For details about setting up new person details, see Setting up a new personnel record on page 12. For an explanation of searching for a particular person, see Searching for a person on page 18. For information about adding photos to a person s record, see Managing a person s photos on page 22. For details of granting access to a person, see Managing a person s access on page 29. For information on issuing and revoking tokens, see Issuing tokens to a person on page 33. For information about checking tokens and dealing with lost and misused tokens, see Managing a person s tokens on page 41. Sateon Release 3.0 11 Issue 0.1
Setting up a new personnel record Within Sateon, personnel are individuals whose details are held on the system for the purposes of access control. You can set up a new personnel record from scratch; alternatively you can base a new record on an existing one (this is known as cloning). Note: You can only set up a new personnel record if you have sufficient user rights. Contact your system administrator if necessary. Creating a new person record from scratch 1. Choose Personnel > Personnel to list the current people on the system. 2. Click Add at the top of the page: 3. On the Basic tab, enter details as follows: Title First Name* Title of the person (Mr, Ms, Mrs, Dr, etc). This is free text so you can enter anything you like (up to 50 characters). First name of the person (up to 128 characters). Surname* Family name of the new person (up to 128 characters). Employee Number Employee or staff number of the person (up to 50 characters: does not have to be numeric). Note that this is optional, but if used, it must be unique. Department The person s department, selected from a dropdown list. This can be left blank if you don t use departments. Note: If necessary, you can create a new department from this page by clicking the button next to Department after you have saved the record. Is Escorted Extend Unlock When selected, this box indicates that this person must be accompanied at any reader that has been specified as an escort reader. (For details of setting up a reader, see the Sateon Access Control Guide.) The accompanying escort s token must have permission on the Secondary Reader Group defined on the nominated escort reader. This means that different people can be the escort on different readers. When selected, this box indicates that this person will be allowed an extended unlock time at certain Sateon Release 3.0 12 Issue 0.1
Area Exempt Allowed To Command Reader Unused Token Exempt Access Start Access End Comment *Required field doors. This setting can be used to assist people with mobility problems. (See also the Extend Unlock setting on the reader record.) If you select this box, the person will be logged in the normal way in and out of secure areas, but anti-passback will not be enforced, so the person will never be refused access through a door because of an anti-passback violation. When selected, this box indicates that this person can issue commands to a reader by entering numbers on the keypad. Depending on configuration, this feature allows doors/readers to be controlled in particular ways, such as unlocking them for a prolonged period of time. Note that this only works on doors/readers when the reader also has the Command Reader setting selected. (For details of setting up a reader, see the Sateon Access Control Guide.) When selected, this box indicates that this person will never have their token suspended because of lack of use. Optionally, you can specify the date/time that this person s access will start. You can enter a date directly or click the calendar icon and select a date and time from the pop-up. If left blank there are no restrictions associated with the personnel record; access times will be affected by the token validity and the times associated with the access groups assigned to the individual. Optionally, you can specify the date/time that this person s access will end. You can enter a date directly or click the calendar icon and select a date and time from the pop-up. If left blank there are no restrictions associated with the personnel record; access times will be affected by the token validity and the times associated with the access groups assigned to the individual. Any additional free-text information about this person. Sateon Release 3.0 13 Issue 0.1
Note: The Where Last Seen field that appears at the bottom of the page indicates where and when this person s token was last read. It will be blank until the person has used the token, and will then show the reader and the time of the last read. Note that Where Last Seen applies whether or not token read was Valid or Invalid. 4. If you want to set up extra data for this person, select the Additional Information tab. This tab lists 20 built-in fields which can be used to provide additional information specific to your organisation. For example, you could record car registration numbers, mobile phone numbers or additional location information. Note that data in these built-in additional 20 fields are included in the search function. This search includes a wildcard function so you can search for all or part of the string. Sateon Release 3.0 14 Issue 0.1
5. Click the Save button to save the changes to the record. Note: As well as these built-in custom fields, you can also have additional user-defined fields on any record. If they have been set up on your system they will appear at the top of this page. The main difference is that you can search for and report on information within the built-in additional fields, while data in the user-defined additional fields is for information only. Details of setting up the user-defined fields is given in the Sateon System Administration Guide. 6. If you want to set specific attributes for this person that may be used by the access control system, select the Personnel Attributes tab. This lists all the attributes that can be assigned: Sateon Release 3.0 15 Issue 0.1
To assign an attribute to the person, select it and click the right-arrow button. It is possible to set up additional attributes: choose Personnel > Personnel Attribute. Note: The core Sateon product does not itself use these attributes. However they may be used by other parts of the system: for example elevator integrations may enable doors to be kept open longer for wheelchair users. Their use depends on a specific implementation and is not described in detail here. Creating a new personnel record based on an existing person 1. Choose Personnel > Personnel. 2. Choose the person you want to base the new record on. 3. Click Clone at the top of the page: A page as follows is displayed: Sateon Release 3.0 16 Issue 0.1
The following fields are copied from the Basic tab of the original personnel record. Title First Name Surname Department Access Start Access End Comment Is Escorted Extend Unlock Area Exempt In addition, any access groups assigned to this person are copied to the new record. 4. Enter or edit the information required as described in Creating a new person record from scratch on page 12. 5. Click Save to save the cloned record. Sateon Release 3.0 17 Issue 0.1
Searching for a person You can search for a particular person using the Filter box that appears at the top of the page: Enter one or more characters to search for and press Return. The display will show all records in which the selected sequence of characters appears in a particular set of fields, as defined below. Note: The search is not case-sensitive. If no match is found no records will appear. To clear the filter at any time and return to the full list of personnel, click the. Defining the personnel fields that are included in the search By default, the fields that are searched are those that are set up by the system administrator in the global preferences settings. However each user can override these settings in their own personal settings. Default personnel search By default, the fields that are searched are those that are set up in the global preferences settings. These can be found in System Configuration > System Administration > Global Preferences and are frequently restricted to Sateon users with system administrator rights. For details of setting these preferences, see the Sateon System Administration Guide. When Sateon is first installed, the following fields are included in the Global User Search Preferences: Title First Name Surname Employee Number Department Token Data However, your system administrator may have amended these to values appropriate to your installation. Setting your own search fields You can override the global settings for the Personnel search and specifically define the fields you want to include in the search. For example, if you have used a Custom Field to record a car registration number, you could include the appropriate field in the search. Sateon Release 3.0 18 Issue 0.1
1. Select the user preferences option at the top-right of the screen and click on Preferences. 2. In the User Preferences dialog, expand the Personnel > Search hierarchy. 3. The fields that are currently included in the Personnel search are selected. To override these settings, select/clear the appropriate checkboxes. 4. Click Save. Sateon Release 3.0 19 Issue 0.1
Running an advanced search To locate specific groups of personnel or to find an individual person, you can use the Advanced Search facility, which allows you to set up very specific search criteria. To run an advanced search 1. On the Personnel page, click on the Advanced Search icon at the bottom of the page. 2. The following dialog appears: 3. To start, click the Add icon: 4. A filter line appears as follows: Sateon Release 3.0 20 Issue 0.1
In the first drop-down, choose a field to filter by. All fields in the Personnel record appear, plus Token and Department data. The fields appear in database order, with fields from additional tables such as Token and Department, appearing at the end of the list, prefixed with the table name. In the second drop-down, choose an operation: one of Is equal to, Is not equal to or Contains. In the third drop-down, enter a value to match against. This gives you a search clause, for example: 5. To add another clause to the search criteria, click the Add icon again to show another blank line and fill it in. 6. To delete a search clause, click in the line of the clause to highlight it and then click the Delete icon: For example: 7. With multiple search clauses, you need to specify whether the system is to find records that match any of them (choose OR) or all of them (choose AND). For example, the following advanced search will return all personnel records where the Department is either Sales or Marketing: 8. Click Apply to run the search. The following advanced search will return all personnel records where the Department is Sales and the person has a token in the Temporary Token Pool. Sateon Release 3.0 21 Issue 0.1
9. Once you have set up the criteria you can click the button at the bottom of the page to find out how many records match the criteria: 10. Click Apply. The Personnel page is redisplayed, listing just those records that match the search criteria. When a filter is applied the Filter box appears in a contrasting colour. To clear the filter and return the entire list, click the Managing a person s photos Photos can be associated with a personnel record, both as a security measure and to help staff quickly and easily identify people. You can capture photos directly from a connected webcam or upload them from a file elsewhere on the system (in.jpg or.png format). Photos within Sateon can also be exported to a file, so for example you can save a captured webcam photo to another location. A number of different photos can be associated with a person, with one of them selected for display by default. You can delete or change a person s photo at any time, and change the one that is displayed. Note: Although there is no theoretical limit to the size of image files that Sateon can handle, we recommend a maximum of approximately 1.5 MB to ensure good performance. If necessary use an image processing application to reduce file size before importing, or for webcams, ensure the webcam is configured correctly. On the main Personnel page, choose the person you want to add a photo to and click Manage Photos at the top of the page: Sateon Release 3.0 22 Issue 0.1
The person s photo page is displayed: If no photos have been added yet, this page will be blank. You can capture a picture from a connected webcam or upload a photo from a file. Capturing a photo from a webcam To capture a photo from a webcam 1. Click Capture at the bottom of the person s photo page to start the webcam capture process: You may need to confirm that the Sateon website is permitted to access the webcam. 2. The Capture Photo dialog appears. Sateon Release 3.0 23 Issue 0.1
3. Click the camera icon at the bottom left of the page. The Webcam Video Feed pane on the left will then display a live feed from the device that you have connected to your computer. 4. Click the camera icon again when you are ready to capture the image. It is displayed in the Snapshot Image pane. 5. Under Snapshot Image, choose the appropriate aspect ratio. (Note that these ratios are given as width:height.)the superimposed rectangle indicates an area of the correct aspect ratio. You can drag and/or resize the rectangle to select part of the original picture and click the Crop icon to show the selection in the Preview pane. Sateon Release 3.0 24 Issue 0.1
Note: If you plan to print tokens that include photographs, you should ensure that all the photos in your system are saved at the same aspect ratio. 6. At any point you can repeat the process to capture another picture. When you are satisfied with the photo, click Save. 7. The persons photo page is redisplayed Uploading an existing photo from file 1. On the person s photo page, click the Upload button: 2. A Windows file selection dialog appears; navigate to the appropriate picture file and click Open. Note that the file selection defaults to.jpg format, but you can amend this to find.png format files. 3. The uploaded photo is added to the photo gallery for this person. Note: You can crop the photo or change its aspect ratio if required, as described in Changing the size of a person s photo below. Note: To ensure a photo is displayed when the person is selected, choose it and click the Make Default button. Sateon Release 3.0 25 Issue 0.1
Changing the size of a person s photo If the original photo is the wrong size or aspect ratio you can easily change it. To crop a photo 1. Click the Manage Photos button at the bottom of the Personnel page to display the person s pictures. 2. Select the appropriate photo from the gallery and click the Crop button at the bottom of the page: The original photo is shown, with a superimposed rectangle of the current aspect ratio. 3. If necessary, change the aspect ratio that you want the cropped image to have (note that these ratios are given as width:height). Note: If you plan to print tokens that include photographs, you should ensure that all the photos in your system are saved at the same aspect ratio. 4. Drag and/or resize the rectangle to select a region of the original picture (the selected region will automatically have the appropriate aspect ratio). 5. Click the Crop icon at the bottom left to see a preview of the selected picture on the right of the page. If necessary, repeat the cropping process until you have an image you are happy with. Sateon Release 3.0 26 Issue 0.1
6. Click Save when you are happy with the photo. The cropped image is added to the gallery. The original is also kept; if you don t want it, just delete it. Setting a default picture You can have a number of pictures for a particular person, with one of them marked as the default to be displayed when that person is viewed. A setting in your personal preferences (Make new images default automatically) allows you to define whether or not a new image is assumed to be the default. If this is set, a new image captured from webcam or uploaded from file will automatically be marked as the default, taking the place of the previous default. If this value is not set, the default picture remains unchanged regardless of new pictures uploaded or captured. You can amend the default manually in either case. To set a default picture 1. Choose Personnel > Personnel. 2. Choose the appropriate person. 3. Click the Manage Photos button at the bottom of the page: 4. The person s photo page is displayed showing any existing photos. The current default is marked by a tick: Sateon Release 3.0 27 Issue 0.1
5. To change the default photo, select the one you want to appear and click the Make Default icon. 6. To remove the default photo setting, click the Clear Default icon. With no default selected, no photo will be displayed when this person s details are viewed in Sateon. Deleting an existing photo 1. Click the Manage Photos button at the top of the pane to display the person s pictures. 2. Select the photo from the gallery and click the Delete button: 3. A confirmation dialog is displayed: Sateon Release 3.0 28 Issue 0.1
4. Click OK to confirm the delete. 5. If you delete the default picture, there will be no default and no picture will appear when this person s details are viewed in Sateon. Exporting a photo 1. Click the Manage Photos button at the top of the pane to display the person s pictures. 2. Select the photo from the gallery and click the Export button: 3. A Windows Save As dialog appears, allowing you to specify the name and location of the saved file. You can also specify whether the picture is saved in.png or.jpg format. Managing a person s access Once a person has been set up you can define the access that is allowed the readers at which the person s tokens are valid. This identifies the buildings, locations and areas that the person can access. To do this you assign particular access groups to the person. Access groups are used to specify the readers, time schedules and system modes that are used to define access. Before setting up access for a particular person, you will need to have set up all the elements needed for access: Readers and reader groups all the readers than control access to doors. Time schedules used to define the times that access is permitted at certain doors. System modes define the situations in which personnel can gain access. Access groups and access permissions categorise the access that is permitted. For more details, see the Sateon Access Control Guide. Sateon Release 3.0 29 Issue 0.1
Viewing and defining access from the Personnel page To view a person s access 1. Choose Personnel > Personnel and choose the person whose access you want to view. 2. Click the Manage Access button at the bottom of the page: 3. The Manage Access page appears: 4. Access groups are listed in the main part of the page, with the access groups assigned to this person selected. If you have a lot of access groups you can limit the display, either to show the access groups allocated to this person or those not allocated to this person. Select/clear the appropriate checkboxes in the Filter pane and click the Apply button. 5. When you select a specific access group, the access permissions within it are listed in the panel on the right. You can expand the permission to show the readers that are associated with it. Sateon Release 3.0 30 Issue 0.1
To define a person s access 1. If there are large numbers of access groups, you can filter the display by entering a string of characters in the Search box at top left. Press Apply to apply the filter. 2. To assign an access group, select the checkboxes for the access groups to be assigned to the person. 3. If access sets have been defined they will appear in the bottom left. If you highlight an access set and click Apply, the access groups within that set are selected. Note: If you subsequently edit an access set to add or remove access groups, these changes are not applied to the people whose access has already been defined. You will need to re-apply the access set for these changes to take effect. 4. For each access group assigned, you can specify the times for this particular person s access to start and finish. If times are already displayed, these are the defaults set up for these access groups, but these can be overwritten. For both Starts and Ends, enter a date directly or click in the field and select the calendar control: 5. When you have finished setting up the access rights for this person, click Save. Note: Remember that an individual s access will also be affected by the start and end dates that apply to the person record and those that apply to the token validity. Granting access to a person from the Access Group page You can also grant access to one or more personnel from the Access Group page (Access Control > Access Management > Access Groups). Note: For full details of setting up access groups and granting access, see the Sateon Access Control Guide. Sateon Release 3.0 31 Issue 0.1
To grant access to one person 1. On the Access Groups page, choose the access group that you want to assign. 2. Click the Manage Personnel Access button at the bottom of the page: 3. The Manage Personnel Access group page is displayed: On this page you can search for and select the person you want to add to the access group. To grant access to multiple people 1. Choose the access group you want to assign. 2. Click the Bulk Grant User Access button at the bottom of the page: Sateon Release 3.0 32 Issue 0.1
3. The Bulk Grant Personnel Access dialog is displayed: 4. On this page you can choose All Personnel or set up criteria to select a specific set of people For full details, see the Sateon Access Control Module Guide. Issuing tokens to a person A person can hold one or more tokens allowing them access at certain readers. Tokens may be permanent or temporary. Note: In normal use tokens are issued from the Personnel page, as you would find the person first. Most functionality can also be carried out from the Tokens page. See Issuing and revoking tokens from the Token page on page 59. Issuing a permanent token 1. Choose Personnel > Personnel.. 2. Choose the appropriate person. See Searching for a person on page 18 3. Click Manage Tokens at the top of the page: Sateon Release 3.0 33 Issue 0.1
4. Any tokens assigned to that person are listed. Any existing tokens are listed on the left. When you click on a token in the list, full details of the token and its status are displayed. 5. To issue a new permanent token, press the Issue Permanent Token button at the bottom of the page: Note: This button is not available if there are no unassigned tokens in the system. 6. All the tokens within the default token pool are listed: You can choose an alternative token pool if required. All pools that are not marked as Temporary Token Pool are available. See Setting up a new token pool on page 52. 7. If there are large numbers of tokens listed, you can filter them by entering a string of characters in the Filter Criteria box. This can be any sequence of characters from the Token Data, Token Status or Token Type fields. For example, you could search Sateon Release 3.0 34 Issue 0.1
for a specific number, or list tokens of a particular type only. Click the Filter button to update the list: 8. To issue a token to this person, select the token that you want to assign from the list. At the bottom of the page you can optionally enter a Reason for the token issue, such as New Employee. 9. Click Issue Permanent Token. The selected token is assigned to the person. The Personnel Current Token screen is redisplayed, with details of the new token. Details of the token assignment can be viewed on the Personnel > Token History page. Note: For a token to permit access, it must have a status of Enabled. Although tokens with other values can be assigned to personnel, any other status will prevent the token from being used. Issuing a temporary token If a person forgets or loses their normal token, you can issue a temporary one. Temporary tokens are those in Token Pools that have the Temporary Token Pool setting selected: Sateon Release 3.0 35 Issue 0.1
It is possible to set up Sateon with so when a temporary token is assigned to a person then all other tokens of the same token type held by this person are made unusable. See Using temporary token workflow on page 37. To assign a temporary token from the personnel record 1. Choose Personnel > Personnel. 2. Choose the person you want to issue the temporary token to. 3. Click the Manage Tokens button at the bottom of the page. 4. A page appears listing the tokens that have already been allocated to this person. To issue a temporary token, press Issue Temporary Token at the bottom of the page: Note: This button is not available if there are no unassigned tokens in the system. 5. A screen listing temporary tokens is displayed. Sateon Release 3.0 36 Issue 0.1
By default the token pool displayed is the pool that has been flagged as for temporary tokens. See Setting up a new token pool on page 52. If you have more than one token pool marked as the temporary token pool you can choose an alternative pool from the Pool drop-down (token pools appear in alphabetical order). If you have no temporary token pools, the token pool marked as the Default Pool is used. 6. If there are large numbers of tokens listed, you can filter them by entering a string of characters in the Filter Criteria box. This can be any sequence of characters from the Token Data, Token Status or Token Type fields. For example, you could search for a specific number, or list tokens of a particular type only. 7. To issue a token to this person, select the token that you want to assign from the list. At the bottom of the page you can optionally enter a Reason for the token issue, such as Forgot Token, Lost Token, etc. 8. Click Issue Temporary Token. The temporary token is assigned to the person and the list of tokens assigned to this user is redisplayed. Details of the token assignment can be viewed on the Personnel > Personnel > Token History page. Note: For a token to permit access, it must have a status of Enabled. Although tokens with other values can be assigned to personnel, any other status will prevent the token from being used. Using temporary token workflow Sateon includes an optional feature which can prevent the use of any permanent tokens when a temporary token is assigned. A specific service setting defines whether temporary card workflow is managed. This can be found in System Configuration > System Administration, under tokenservice: Sateon Release 3.0 37 Issue 0.1
If the tempcardworkflow checkbox is selected, temporary card workflow is enabled. Note: It may be the responsibility of the system administrator to change this setting, which is not set by default when Sateon is first installed. When temporary workflow is enabled When a temporary token is assigned to a person then all other tokens of the same token type held by that person are set to Lost and are therefore unusable. (Any tokens of any different token type are unaffected.) When the temporary token is revoked from that person the Lost tokens are automatically reset to their original status. Note that only one temporary token can be assigned to the person. The temporary token can be assigned as described in Issuing a temporary token on page 35 and revoked as described in Revoking a token on page 39. Details of tokens issued and revoked for a specified person can be viewed on the Token History page. The following screen shows the Manage Tokens Diagnostics page for a person with multiple tokens. When the temporary card (95051197) was assigned, the two tokens of the same type were set to Lost. Sateon Release 3.0 38 Issue 0.1
If the tempcardworkflow service setting is set to False, the status of other tokens will not be automatically changed. To prevent access, the status of tokens can be set manually. Note: For a token to permit access at a reader, it must have a status of Enabled. All other values will prevent the token from being used. Revoking a token 1. Choose Personnel > Personnel. 2. Choose the person whose token you want to revoke. 3. Click the Manage Tokens button at the bottom of the page: 4. The following dialog appears: Sateon Release 3.0 39 Issue 0.1
This page lists all the tokens currently allocated to the person. 5. Select the token to be revoked. If the person has several assigned tokens, ensure you select the right one. 6. Click Revoke Token at the bottom of the page. A dialog appears: 7. Enter a reason for revoking the token. Select the Remove token on revoke box if this token is to be deleted from the database as well as being revoked. (If this is not selected, the token is returned to the appropriate token pool.) 8. Click the Revoke button. Note: If the token being revoked is a temporary token and temporary card workflow is enabled, any other tokens of the same type are restored to their previous status. Sateon Release 3.0 40 Issue 0.1
Managing a person s tokens Sometimes you may need to check a person s token status or deal with lost and misused tokens. You can do this easily from the Manage Tokens page. Checking a person s tokens On the Personnel page, you can check the tokens that a person holds, for example to check the current access permissions or the status of the token. If there are any problems, you can fix them directly from this page. 1. Choose Personnel > Personnel 2. Choose the person whose tokens you want to check. 3. Click the Manage Tokens button at the bottom of the page: The Token Data page appears: The icon against each token is an indicator of its status. A green icon indicates that all aspects of this token are OK (token validity, personnel configuration and access permissions). The person will be able to gain access according to the specified access permissions. A red icon indicates that no access is permitted at all, for example if the token has been suspended or if the date/time is outside the validity periods for either the person or the token. Sateon Release 3.0 41 Issue 0.1
An orange icon indicates that the token validity and personnel configuration are OK but the access permissions assigned to this person do not allow access at the current time. 4. For full details of the token state, select the Diagnostics tab. 5. The Personnel Configuration section shows the start and end dates of the period that this person is allowed access. A red marker here means this person s access period either hasn t started yet or has finished. Click the Edit icon to amend this information: 6. This Token Configuration section indicates the token validity dates and the token status. A red marker here means this token s dates are invalid or the status is not Enabled. Click the Edit icon to amend this information: Sateon Release 3.0 42 Issue 0.1
7. The Current Access Permissions section indicates whether the user has been assigned access groups that permit access at present. An orange marker here means either this person has not been assigned any access groups, or that the access groups that are assigned do not permit access at present. Click the Edit icon to amend this information: Select appropriate access groups or edit the Start and End dates if necessary. Sateon Release 3.0 43 Issue 0.1
Creating a new token from the personnel page If you need to assign a token to a user and you do not have a suitable token available in a token pool, you can set one up directly from the Personnel page. To create a token from the personnel record 1. On the Personnel page, choose the appropriate person. 2. Click the Manage Tokens button at the bottom of the page: 3. The following dialog appears: 4. Click the Create Token button at the bottom of the page. The following dialog is displayed: Sateon Release 3.0 44 Issue 0.1
5. The Token Data field specifies the full number of the token. This can be entered directly if you know the number; it must be the full number consisting of the site/ facility code followed by the token ID number. Alternatively you can scan the token at any reader in the system and select the button next to the Token Data field. The following dialog appears, displaying any token IDs that have been read but are not already in the system: Sateon Release 3.0 45 Issue 0.1
Choose the appropriate token and click Save. 6. Enter the rest of the data as follows: Token Status* Token Pool* Token Type* Valid From Valid To Show PIN Pre-defined PIN Personnel defined PIN Issue Type Reason *Required field Select the initial status of the token. Note that this must be Enabled if the token is to be used straight away. The default token pool appears here but you can choose a different one. Choose the type of token. If a default token type has been set, it will appear here. To set up new token types, or set a default token type, see Setting up a new token type on page 50. Optional. If required, specify the start of the date/time range for which the token is valid. You can enter the date directly or click the calendar icon and select a date and time. Optional. If required, specify the end of the date/time range for which the token is valid. You can enter the date directly or click the calendar icon and select a date and time. Select this box to view the PIN, if used. Choose this if you want to set a system PIN and choose a value from the drop-down. Choose this if you want to set a specific PIN, and enter a value directly. Choose Issue Permanent Token (such as for a new employee) or Issue Temporary Token (such as for a forgotten token). Optional reason for the token issue, such as New Employee, Forgot Token, etc. 7. Click the Save button to create the token and assign it to the person. Dealing with a lost token All tokens have a status which appears at the top of the appropriate page. Only tokens that have a status of Enabled can be used to gain access. If a person reports a token missing you can mark it as Lost or Stolen, which temporarily removes all access rights associated with the token, preventing it from being used. Sateon Release 3.0 46 Issue 0.1
To mark a token as lost or stolen from the personnel record 1. Choose Personnel > Personnel. 2. Select the appropriate person and click the Manage Tokens button at the bottom of the page. 3. If the person has multiple tokens, ensure you select the correct one. 4. In the Token Status field, choose Lost or Stolen from the drop-down: 5. Click Close. The status of the token is changed. A token with a status of Lost or Stolen will not permit access at any door. 6. If the token is subsequently found, you can reset the status to Enabled. Managing misused tokens Tokens can be automatically suspended by the system if they are misused. For example, if a token is used repeatedly to attempt access to an area where the person does not have permissions, if access is attempted outside a valid time schedule, or if a PIN is incorrectly entered multiple times. Once a token is suspended, only a Sateon system administrator can reset it. Automatic suspension works by assigning penalty points when certain actions occur. The penalty points that apply in your organisation can be set in the Service Settings within System Configuration (for details, see the Sateon System Administration Guide). The default values that apply are as follows: Action Access attempt at a reader where the user does not have access rights Access attempt at a reader where the user does not have access at the specified time No of points Wrong PIN entered 40 30 20 Sateon Release 3.0 47 Issue 0.1
When a certain number of points have accrued, the token is suspended. This threshold value can be set according to the security requirements of the site. Points on a token also expire at a rate of 1 point every 6 minutes, so eventually a suspended token will be usable again. Alternatively, a suspended token can be reset by someone with sufficient access permissions. If you suspect a token has been misused, you can manually set it to Suspended, removing all access rights associated with it. To suspend a token directly 1. Choose Personnel > Personnel. 2. Select the appropriate person and click the Manage Tokens button at the bottom of the page. 3. If the person has multiple tokens, ensure you select the correct one. 4. Click the Suspend icon: 5. The token is suspended immediately. In this state, it will not permit access at any door. You can check this on the Diagnostics tab: To subsequently reset the permissions associated with this token, you can click on Reset Suspend. To reset a token 1. Choose Personnel > Personnel. 2. Select the appropriate person and click the Manage Tokens button at the bottom of the page. 3. Select the suspended token and click the Reset Suspend button. 4. The previous access rights are immediately restored. You can check this on the Diagnostics tab. Sateon Release 3.0 48 Issue 0.1
Section 3 Managing tokens This section explains how to set up and manage access tokens within Sateon. It includes the following: For details of creating token types, token pools and token statuses, see Setting up supporting data on page 50. For details of setting up new tokens, see Setting up new token records on page 53. For information about assigning and revoking tokens, see Issuing and revoking tokens from the Token page on page 59. For details of examining information about tokens, see Viewing details of tokens on page 61. For an explanation of printing tokens, see Printing a token on page 63. Sateon Release 3.0 49 Issue 0.1
Setting up supporting data Within Sateon, a token is any object which a person can make use of to gain access to particular sites, buildings or areas within your organisation. Certain information is needed to support tokens: The specific types of tokens that you use in your organisation. For example you could use several types of readers and have different tokens for them. The token pools logical groupings of tokens with similar characteristics. For example, you could have a pool of permanent tokens, and a pool of temporary tokens. You could also have groupings of different token types for different parts of the organisation. The valid status values that apply to tokens. Default values are present in Sateon but you may wish to set up additional values. Setting up a new token type Token types are used to identify the sorts of tokens in use in your organisation. For example, you could use mag-stripe cards, smartcards and proximity devices from one or more manufacturers. Each type of token must be matched to one or more different types of readers. If the terms of your licence permit it, you can also have tokens that use different access technologies. For example a single token can be used with a regular card reader and also with a wireless lock technology. Many organisations will only use one type of token, so a default token type can be set up which will apply automatically when creating new tokens. This data is normally set up when your system is first commissioned, but changes can be made later if needed. To create a new token type 1. Choose Personnel > Token Types. 2. Click Add at the top of the page: 3. Enter the following fields: Description* Is Returnable Can Print The identifying name of the new token type. Select this box if the tokens of this type can be returned from the person. Select this box if tokens of this type can be printed. You need to ensure this is set if tokens are to be printed. Sateon Release 3.0 50 Issue 0.1
Remove Token on Revoke Default Setting Is Default If this box is selected, the token is automatically deleted from the system if it is revoked from the person. Select this box to mark this token type as the default which will apply to tokens subsequently created. Note: Only one token type can be set as the default. If you edit the record and select a different default the new default token type is applied as soon as the change is saved. No warning appears. *Required field 4. You then need to define the access technologies and reader types that will be supported on your system. For each different technology and reader combination supported, select requirements and add it to the list by clicking the following button: If you only have one type of reader in your organisation, this may be as simple as a single Reader Type using standard Sateon Technology Type. However, if you use other lock/access technologies, such as wireless locks, you can select these from the Technology Type drop-down. (For details of these, see the documentation for the specific integration.) Sateon Release 3.0 51 Issue 0.1
5. When you have set up all the combinations, click Save. Setting up a new token pool Token pools are used to group tokens with similar characteristics or purposes. All token records within Sateon must be assigned to a pool. Two token pools are included in Sateon by default: Permanent and Visitor token pools. However, if required, you can set up a new pool (or amend the existing ones). To create a new token pool 1. Choose Personnel > Token Pools. 2. Click Add at the top of the page: 3. Enter the following fields: Description Temporary Token Pool Default Token Pool *Required field The identifying name of the new token pool. Select this box if any tokens issued from this pool are to be treated as temporary. When you issue a temporary token you can select from the pools that have this box selected. Select this box to indicate that this token pool is the one used by default when issuing permanent tokens. Only one pool can be the default; to change it you need to clear the existing setting first. Note: If the Temporary box is selected for a token pool, you will need to override the setting for an individual token if you want to make it a permanent issue. 4. To allocate tokens to this pool, click the Manage Tokens button at the bottom of the page. Tokens are listed as follows: Sateon Release 3.0 52 Issue 0.1
5. You can move tokens into or out of this pool by clicking the arrow buttons. 6. Click Close. Note: You can also set the pool that a token is in from the Token page. Setting up a new token status All tokens have an associated status. By default the possible status values are Enabled, Damaged, Lost, Not Returned, and Stolen. Additional statuses can be created, but note that these are for information purposes only they are not used by Sateon and will not permit access. Status values of Enabled, Lost, and Not Returned cannot be deleted. Note: For a token to permit access at a reader, it must have a status of Enabled. Any other value will prevent the token from being used. The status will appear on the screen when the token is selected and will be shown in the Control Centre when an event related to this token occurs. This enables security personnel to see at a glance if a token is being used when it shouldn t be. To create a new token status 1. Choose Personnel > Token Status. 2. Click Add at the top of the page. A set of blank fields appears. 3. In the Description field, enter a name for the new token status: Sateon Release 3.0 53 Issue 0.1
4. Click Save. The new token status can be selected on the token page. Setting up new token records You can set up new token records at any time. You can either create a single token as required or create a batch of tokens (with sequential numbers) at once. Each token has a status, and only tokens with a status of Enabled can be used to permit access. Additionally, a token can be set to be valid for a particular date/time range. If a token is assigned to a person before its validity period, it will be shown as Pending and will not allow access. Creating a single token 1. Choose Personnel > Tokens. 2. Click the Add button at the bottom of the page: 3. A set of blank fields appears. The Token Data field specifies the ID number of the token. If you know the number you can enter it directly; it must be the full number consisting of the site/ facility code followed by the token ID number. Alternatively you can present the new token to any suitable reader in the system and select the button next to the Token Data field: The following dialog appears: Sateon Release 3.0 54 Issue 0.1
Select the appropriate reader to view token IDs that have been read. Choose the appropriate token and click Save. 4. Enter the rest of the data as follows: Token Status* Token Pool* Token Type* Card Identifier Valid From Select the initial status of the token. Note that this must be Enabled if the token is to be used straight away. To set up a new token status, see Setting up a new token status on page 53. Select the pool that this token belongs to from the drop-down list. Note that this is just a label if you select a token from the Temporary Pool this does not automatically mean that it is temporary. To create a new token pool, see Setting up a new token pool on page 52. Choose the type of token from the drop-down list. This is populated by all the types of token available in your system. If a default token type has been set, it will appear here. To set up new token types, or set a default token type, see Setting up a new token type on page 50. Only used when migrating data from a JANUS system to Sateon. Holds the JANUS Card ID. Optionally, specify the start of the date/time range for which the token will be valid. You can enter the date directly or click the calendar icon and select a date and time from the pop-up. Sateon Release 3.0 55 Issue 0.1
Valid To Show PIN Pre-defined PIN Personnel-defined PIN *Required field. You can set a date in the future if you wish. If you set a date but not a time, the start time will be set to 00:00 and the token will be valid from midnight at the beginning of the specified day. If appropriate, specify the end of the date/time range for which the token is valid. You can enter the date directly or click the calendar icon and select a date and time. If you set a date but not a time, the end time will be set to 00:00 and the token will be valid until midnight at the end of the specified day. If a person is required to enter a PIN at a keypad associated with the reader, select this box to view the PIN. Select to choose a PIN from a list of systemgenerated options that appear in the drop-down box. Select to set a PIN with a specific number. 5. Click Save to create the new token. Sateon Release 3.0 56 Issue 0.1
Creating a batch of tokens 1. Choose Personnel > Tokens. 2. Click the Add Batch button at the bottom of the page: 3. Enter the following data: Start Token Data* End Token Data* Token Pool* Token Type* Token Status* Tenant Valid From Valid To The ID number of the first token in the batch. The ID number of the last token in the batch. Note that the maximum number of tokens you can create in a batch is 1000. Select the pool that these tokens belong to from the drop-down list. Note that this is just a label if you select a token from the Temporary Pool this does not automatically mean that it is temporary. To set up a new token pool, see Setting up a new token pool on page 52. Choose the type of token from the drop-down list. This is populated by all the types of token available. If a default token type has been set, it will appear here. To set up new token types, or set a default token type, see Setting up a new token type on page 50. Select the initial status of the tokens in this batch, e.g. Enabled. This appears if Tenancy features are supported and licensed for this installation. Where necessary, select the tenant that these tokens are to be assigned to. If appropriate, specify the start of the date/time range for which the tokens in this batch are valid. You can enter the date directly or click the calendar icon and select a date and time from the pop-up. You can set a date in the future if you wish. If you do not select a time, the start time will be set to 00:00 and the tokens will be valid from midnight. If appropriate, specify the end of the date/time range for which the tokens in this batch are valid. You can enter the date directly or click the calendar icon and select a date and time. If you do not select a time, the end time will be set to 00:00 and the tokens will be valid until midnight. Sateon Release 3.0 57 Issue 0.1
*Required field 4. Click Create to create the new batch of tokens. The following dialog appears when the process is complete: 5. Click Close. Sateon Release 3.0 58 Issue 0.1
Issuing and revoking tokens from the Token page Normally you would issue a token from the Personnel page. See Issuing tokens to a person on page 33. Issuing a token from the Token page You can issue a permanent or a temporary token from the token page. To issue a token 1. Choose Personnel > Tokens. 2. Choose the token you want to assign. 3. Click Issue Token at the top of the page: Note: You cannot select the Issue Token icon if the selected token is already assigned to a person. 4. A screen of the following format appears: Sateon Release 3.0 59 Issue 0.1
This page lists all existing personnel. 5. You can restrict the list as follows: By entering a string of characters from the First Name, Surname or Employee Number into the Filter box. By choosing a Department from the drop-down list. Then click Filter. All users matching the search criteria are listed. 6. Select the person to assign the token to. 7. Enter a Reason for the token issue, such as New Employee, Lost Token, etc. 8. Choose Temporary Token (such as for a forgotten token) or Permanent Token (such as for a new user). 9. Click Save to assign the token. Revoking a token from the Token page You can revoke a token from a person to unassign it. There may be various reasons for this: an employee is leaving the organisation, the token was issued on a temporary basis and so on. When a token is revoked it is returned to the appropriate token pool and can be assigned to someone else. Alternatively it can be deleted if it is no longer required. Note: If the token has simply expired, the end time of its validity period can be updated. To revoke a previously issued token 1. Choose Personnel > Tokens. 2. Choose the token you want to revoke from a person and click Revoke Token at the top of the page: 3. A screen of the following format appears. Sateon Release 3.0 60 Issue 0.1
4. Optionally, enter a reason for revoking the token. Select the Remove token on revoke box if this token is to be deleted from the database as well as being revoked. (If this is not selected, the token is returned to the appropriate token pool). 5. Click the Revoke button. Note: You can also revoke a token from the appropriate personnel record. See Revoking a token on page 39. Viewing details of tokens You can check the tokens that a person holds, for example to check the current access permissions or the status of the token. On the Token page you can view the current state of a token, the reader at which it was last used and the number of points that have been accrued. You can also view information about token assignment and status changes relating to a selected person on the Personnel record. Viewing details of token status If a token is misused: for example, used repeatedly to attempt access to an area where the person does not have permissions, outside a valid time schedule, or if a PIN is wrongly entered multiple times, the token will accrue penalty points. The number of points is configurable at a system level. When a certain number of points is reached, the token is automatically suspended by the system. It is also possible to suspend a token manually, if unauthorised access is suspected. Once a token has been suspended, it cannot be used to gain access until it is reset by a suitable system user. On the Token page you can view the current state of a token, the reader at which it was last used and the number of points that have been accrued. To view details of the token 1. Choose Personnel > Tokens. 2. Find the token you want to check (you can search for a token by entering characters from the Token Data field). 3. Select the Token State tab: Sateon Release 3.0 61 Issue 0.1
4. This tab indicates where and when the token was last used, shows the number of points accrued and whether or not the token is suspended. Viewing token history You can view information about token assignment and status changes relating to a selected person on the Personnel record. Note: If you want to view other activity associated with the person and their token usage, use the Control Centre. See the Sateon Control Centre Module Guide for details. Sateon Release 3.0 62 Issue 0.1
To view a person s token history 1. Choose Personnel > Personnel. 2. Choose the person whose token data you want to view. 3. Click the Token History tab. Details of this person are displayed as follows: 4. This tab lists details token events and changes of status relevant to that person since the personnel record was created. No changes can be made from this page. Note: To display recent changes, you may need to click the Refresh button at the top of the page. Printing a token You can print tokens from within Sateon. Cards can be printed on special card printers, while paper versions can be printed on a normal printer. Token designs can contain personal data from the Sateon database such as name, employee number and department as well as photos. They can also include standard text and graphics such as company names and logos. Before you can print a token from the Personnel page, the design you are using must already have been configured in the System Configuration > Printing options. Some sample token designs are included in Sateon: additional ones can be created and modified using the Telerik Report Designer. See the Telerik Report Designer User Guide. They are created as Telerik reports (.trdx files), and can then be imported into Sateon. You can only print a token if: The appropriate token type has the Can Print setting selected. See Setting up a new token type on page 50. The token is assigned to a person. One or more card printing designs have been assigned to the specific token type and have been defined as a User design type. This information is set up in the Printing option of System Configuration. See the Sateon System Administration Guide for details. Note: The card printer you are using may have its own requirements and restrictions. Sateon Release 3.0 63 Issue 0.1