SECURE ACCESS MAN AG E R USER GUI DE E X O S T A R, LLC D A T E : M AY 2 0 1 7 V E R S I O N : 4.0 1
S E C U R E AC C E S S M A N A G E R 1 INTRODUCTION... 3 1.1 SUMMARY... 3 2 BASIC FUNCTIONS... 3 2.1 LOGIN TO YOUR SAM ACCOUNT... 3 2.1.1 Account Activation... 3 2.1.2 Secure Access Manager Subsequent Login... 5 2.1.3 Forgotten Password... 6 2.1.4 Expired Passwords... 8 2.1.5 Forgotten Security Questions... 9 2.2 SAM PORTAL... 10 2.2.1 The Home Tab... 11 2.2.2 The My Account tab... 12 3 APPLICATION MANAGEMENT... 13 3.1 APPLICATION STATUS MANAGEMENT... 13 3.1.1 Request Application Access... 13 3.1.2 Pending Acceptance of Terms & Conditions... 15 4 ACCOUNT MANAGEMENT BY USER... 15 4.1 EDIT PROFILE... 16 4.2 VIEW ORGANIZATION DETAILS... 18 4.3 CHANGE EMAIL... 19 4.4 CHANGE PASSWORD... 19 4.5 CHANGE SECURITY QUESTIONS... 20 4.6 OTP... 21 4.7 ACCOUNT DISABLEMENT... 22 4.8 USER SELF REGISTRATION... 23 2
1 Introduction 1.1 Summary Exostar s Secure Access Manager (SAM) is a consolidated portal used for account registration, authentication, and management. The authentication gateway is used to support access to applications and services hosted by Exostar and those managed by external entities. SAM s objective is to consolidate registration processes for connecting partners and applications, while providing flexible management and invitation capabilities to application owners. Key Functions of SAM include: Extending the basic concept of Web based Single-Sign-On (SSO) to support single sign on and access to multiple applications. Supporting authentication credentials of varying assurance levels. Facilitating an organizational approach to registration, account management and application access. Provides organizational control over new user approval and access requests. 2 Basic Functions 2.1 Login to your SAM Account Whether logging in to SAM for the first time, returning to the portal, or logging in via EAG, you can access the portal at https://secureaccess.exostar.com. 2.1.1 Account Activation Upon creation of a SAM account, you will receive email notification containing the link to activate their SAM account. The account activation process will include creation of a password, and selection of security questions. The account activation email will be resent 2 times every 30 days, and new activation notifications will supersede activation links sent in previous emails. Account activation needs to be completed within 180 days or the account will be deactivated (deleted). Once you have completed the first time login and are actively using the applications, you will be required to change your password every 90 days. Note: Accounts created prior to the SAM 3.3.2 release should follow the activation instructions in the email they received (follow the First Time Login process using the one-time password and system-generated password provided in email). The steps will differ from those listed below. Administrators for accounts created prior to the SAM 3.3.2 release can navigate to the user s profile and choose to resend activation email to trigger an activation email for the user to follow. 3
You can begin by clicking the activation link in the email, or by accessing the portal at https://secreaccess.exostar.com. Below are steps to complete your account activation: 1. Upon receipt of the activation notice, click the Activation Link provided in the email. Note: If you do not use the email to initiate the process, and enter your email address on the SAM login screen, you will be prompted to enter captcha in order to resend Activation email. 2. You will be prompted to create a password and to set security questions. Note: Passwords must be 8 to 16 characters long. They must include at least 4 different characters, 1 alphabetic character, 1 numeric character, and 1 special character. Leading and trailing spaces are not allowed. Passwords will expire after 90 days. 4
3. Create your password reset secrets by selecting and responding to four security questions. Note: Your security questions and answers will be required if you need to reset/change your password at later time. 4. Upon successful entry of authentication information (password and security questions), you will be redirected to SAM portal. You have now completed the first time login process. 2.1.2 Secure Access Manager Subsequent Login Once you have completed the account authentication login process, and have established their password and security questions, the subsequent Login to SAM will be as follows: 1. Go to the SAM login portal: https://secureaccess.exostar.com. 2. Enter your User ID or Email address. Click Continue. SSO/EAG users will have a cookie installed which redirects to their organization R-IdP. If the user deletes the cookie or uses another browser, entering the email address will redirect the user to the proper R-IdP. 5
3. Enter your password. Click Login. Note: If the system recognizes that your credential has not been activated, you will be prompted to resend the activation email. 4. Upon successful login, the SAM Home tab is presented. The home tab includes access to applications and organization information. 2.1.3 Forgotten Password Follow the steps below if you Forgot Password: 1. Access the SAM login page at https://secureaccess.exostar.com and enter your User ID/Email address. 6
2. Click Forgot Password link. 3. Enter your user ID. Click Continue. 4. Select and answer two of your security questions that were established during account activation. Click Continue. 7
5. Enter your new password. Reenter the password for confirmation. Click Submit. Note: Passwords must be 8 to 16 characters long. They must include at least 4 different characters, 1 alphabetic character, 1 numeric character, and 1 special character. Leading and trailing spaces are not allowed. Passwords will expire after 90 days. A confirmation page is displayed confirming that the password has been changed. 2.1.4 Expired Passwords SAM passwords are set to expire after 90 days. If you attempt to login and your password has expired, follow the steps below to reset your password: 1. After a failed attempt to login due to an expired password, click Reset Password. 8
2. Select and answer two of your security questions that were established during account activation. Click Continue. 3. The Create New Password page is displayed Enter your new password. Reenter the password for confirmation. Click Submit. Note: Passwords must be 8 to 16 characters long. They must include at least 4 different characters, 1 alphabetic character, 1 numeric character, and 1 special character. Leading and trailing spaces are not allowed. Passwords will expire after 90 days. A confirmation page is displayed confirming that the password has been changed. 2.1.5 Forgotten Security Questions The security questions and answers are necessary in order for you to reset account passwords. In the event that you forgot your security questions, follow the steps below: 9
1. Select the Forgot Security Questions/Answers? link. 2. Enter your email address and zip/postal code associated with this account. Click Continue. 3. A confirmation page is displayed and you will receive an email containing a temporary, system-generated password. 4. Return to the login page and enter you user ID and system generated password. 2.2 SAM Portal Upon login to the SAM portal, the landing pages consist of two tabs: the Home tab and the My Account tab. 10
Home tab contains several containers of information including My Applications, My Organization, My Tasks, and Account Summary. My Account tab allows you to edit their account profile, view organizational details, and manage email address, password and security questions. Administration tab is available to Organization Administrators and is used for user management. New users will be created within this tab, and existing user profiles can be updated. In addition, the administrator may subscribe the organization to additional Applications. Provider Administration tab is available to Service Provider Administrators and is used to manage Organization and User account subscriptions and access. The SP Admin role is not an org level administrator, but rather a system level administrator assigned by Exostar. Registration Requests tab is available to Administrators and is used to grant SAM account approvals and application access to users who self register. It is also used to approve users for OTP Token use. 2.2.1 The Home Tab When a user logs in to SAM, the Home tab is displayed featuring a dashboard of information. In addition to providing application access, this screen will contain summary information about the user s organization, tasks, and account. Note: The +Expand All Sections will expand each of the remaining containers. Each container may also be expanded individually by clicking on the containers link. 11
o My Applications container: The My Applications container lists applications that your organization has subscribed to and the status of your account for each of those applications. If your status is Active for an application, the action column will allow you to click Open Application and launch the application. o My Organization container: The My Organization container provides the Organization ID and a summary of user statuses within your organization. The View Organization Details link provides access to the Organization Details page under My Account tab. o My Tasks container: The My Tasks container provides a consolidated list of to-do items with a link directly to each of the tasks. This may include Organization subscription requests as well as Password Expiration notices. o Account Summary container: The Account Summary container provides a summary of your account and your role(s) within SAM. The View Account Details link provides access to the Edit Profile page. 2.2.2 The My Account tab The My Account tab allows you to manage their account profile, email address, password, security questions, and to view organization details. Edit Profile allows you to update your user profile information and link your SAM account with your R-IDP account. View Organization Details displays information about your organization including your Organization ID. Change Email* allows you to update your email address. 12
Change Password* allows you change your current password. Note: The application will require you to change your password every 90 days. Change Security Questions* allows you to change the security questions that you established for your account during your first time login. OTP allows you to register, manage, or elevate the phone-based OTP functionality. * Does not apply to SSO EAG connected users. 3 Application Management The SAM portal Home tab displays all the applications that your organization subscribes to with information on the status of these applications for your account and available actions for you. It also shows any messages/announcements from Exostar or the application owner. 3.1 Application Status Management There are several user Status that may be associated with an account: # Status Status Description User Action 1. Active 2. 3. 4. Organization Registration Approval Pending Pending account creation by the Application Pending Approval by the Application Owner 5. Pending Activation 6. Pending Acceptance of Terms & Conditions 7. Inactive 8. Suspended Subscription has been approved to access the application. The organization s request for subscription to the application has not yet been approved. No user can request access to the application. The application has not yet been provisioned by the Service Provider (SP). Request is pending approval by the SP Administrator. The SCP App Admin has not yet activated your SCP application subscription. The Organization Administrator (Org Admin) has not yet accepted the Terms & conditions for access to the application. You are not subscribed to the application, but the organization is subscribed to the application. The Org Admin & EPA can also request application subscription on your behalf. Your application access has been suspended. Click 'Open Application' to launch the application in a separate browser window. None. None. None. Contact the App Admin for the SCP application. Contact the Org Admin for information. If you need access to the application, click on the Request Access button next to the inactive status. Your request will then be in Pending Application Administrator Approval status. None. 3.1.1 Request Application Access You can request access to applications that they are not currently subscribed to by using the Request Access action. 1. Login to SAM. Expand the Applications container on the Home page. 13
2. Locate the application that you would like access. Click the corresponding Request Access link. 3. Enter the desired subscription period. 4. A confirmation page is displayed which provides a reference number. What happens next? The Application owner (SP Admin) will receive a notification to approve your access to the application. Once the SP Admin has approved the access, you will receive a notification that your access to the application has been approved. 14
3.1.2 Pending Acceptance of Terms & Conditions Organization Administrators will have access to view Service Agreements while awaiting provisioning of an application. Users within the organization will NOT have access to a specific application until the Service Agreement has been accepted. To accept a Service Agreement and enable access to the application: 1. Login to SAM. Click View Service Agreement to review and accept the agreement. 2. The Agreement page is displayed. 3. Review the agreement. Click I Agree to accept the agreement. A confirmation page is displayed confirming that the agreement has been successfully accepted. What happens after accepting the Service Agreement? 1. Administrators may begin to add users to the application. 2. User within your organization may request access to the application. What happens if you do not accept the Service Agreement? 1. If you select Cancel : You will be taken back to the Applications page. 2. If you select I Do Not Agree : Your application subscription will remain pending and the View Service Agreement button will be made available again. 3. Users within your organization will not be able to access this application until the agreement is accepted. 4 Account Management by User Users have the ability to manage their accounts within the SAM portal. The My Account tab consists of links that allow you to: Edit Profile, View Organizational Details, and Change Email, Password, and Security Questions, and OTP. 15
4.1 Edit Profile The Edit Profile Page allows you to view and modify your user profile information and allows you to link SAM account to your Remote Identity Provider Account. To Edit your Account Profile: 1. Login to SAM. Access the My Account tab. Your profile page is displayed. 2. Review the profile information and make desired changes. Click Continue. 16
3. A review page is displayed. Review and verify that the changes have been entered correctly. Click Submit to process the changes. 4. The confirmation page is displayed confirming that changes have been processed. You will receive an email confirming the changes. 17
4.2 View Organization Details The View Organization Details link provides you with information regarding the following: Organization Details: including name, address, Org ID Credential Buyer information Organization Contact Org and App Admins Subscribed Applications Application Administrator contact information per application 18
4.3 Change Email The Change Email feature allows you to change the email address associated with their SAM account. Emails must be unique in the system and cannot be linked to multiple accounts. When changing an email address, it is important that you contact all project partners and advise of the change to ensure that you may continue to access the applications. Note: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access Change Email tab. 1. Login to SAM. Open the My Account tab and click the Change Email link. 2. Enter your new email address. 3. Access your email to obtain the activation code. 4. Return to the SAM portal and enter the activation code. 4.4 Change Password The Change Password feature allows user to change their SAM account password. 19
The new password must comply with the Password Strength Policy as follows: Must contain a minimum of 8 characters and a maximum of 16 characters. Must contain at least 4 distinct characters, 1 alphabetic character, 1 numeric character and 1 special character such as!,@,#,$,% etc. Leading and trailing spaces are not permitted. Note: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access the Change Password tab. 1. Login to SAM. Open the My Account tab and click the Change Password link. 2. The Change Password page is displayed. Enter your current password. Enter the new password, and re-enter for confirmation. 3. Click Submit. 4.5 Change Security Questions The Change Security Questions feature allows you to change the security questions that have been associated with their SAM account. Please note the following regarding your Security Questions: Security questions are used when you have forgotten your password or when you need to change your password. The system will only require you to remember two of the four questions when resetting your password. Each of your question and answer combinations must be unique. The answers to the security questions are case-sensitive. 20
You cannot select the same question twice. Note: If your account has been linked to your corporate network account via Enterprise Access Gateway (EAG), you will not be able to access the Change Security Questions tab. 1. Login to SAM. Open the My Account tab and click the Change Security Questions link. The Change Security Questions page is displayed. 2. Locate and select the question/answer combination to be changed. 3. Make desired changes and click Submit. A confirmation page is displayed confirming that changes have been processed. You will receive an email confirming the changes. 4.6 OTP The OTP link allows you to register, manage, elevate or deactivate the phone-based OTP. OTP service may be linked using the phone or hardware options. Follow the steps below to register and activate the OTP service: 1. Login to SAM. Open the My Account tab and click the OTP link. 21
2. Click Register to register a new device to your account. 3. Confirm user information, select the Country, and click Next. 4. Complete all required fields. Click I Agree. 4.7 Account Disablement Inactivity on your account may result in the account being suspended or deleted. The following are some reasons why your account may get deleted or suspended: First Time Login not completed for more than 180 days If you have not completed First Time Login (account activation) for your SAM account within 180 of account creation, your account will be deleted. If your account is deleted, you will have to reregister in the system. Application access suspension Each application can set the parameters for the number of days of inactivity that will lead to access suspension. If your application access is due for suspension in 30 days or less, each time you login to your SAM account, you will be presented with a flash screen to remind you to access the application and the number of days to suspension. To ensure that you do not lose access to the applications you need, it is a good practice to login to your SAM account regularly and access available applications. 22
Application access deletion If your application access has been suspended for x number of days as specified by the application owner, your access to the application will be deleted. You will be notified regarding this deletion 30 days in advance. Active account deletion: If the last active application subscription is suspended, your SAM account will be suspended 30 days after the application suspension. You will be notified regarding this suspension 30 days in advance. Contact Exostar Customer Support for information on how to re-establish application access. 4.8 User Self Registration You can initiate the process of creating their SAM account and requesting application access by going through the User Self-Registration process. Follow the steps below to complete self-registration: 1. Go to https://secureaccess.exostar.com/userregistration. Complete all required fields. 23
Notes: After you enter the Organization ID, click Verify Organization to populate the next two fields. All required fields are denoted by *. It is recommended that you use your organization domain email address, not a personal email address. 2. Select the application(s) for which you would like access. Indicate the subscription period. The products and services that are listed on this page are based on selections made by your organization. Click Next to continue. Note: In order to access applications with higher level security (i.e, Level 3) the Sponsor Email Address must match an email within the sponsoring organization 3. The Submission Confirmation page is displayed and your request has been sent to your Administrator. Note: The reference number is provided and should be used if you need to contact Customer Service for support with SAM related issues or questions 4. You will receive an email confirming that your request has been received. No further action is required on your part at this time. Your Organization Administrator will be notified of the pending request. 24
5. Once your request has been approved, you will receive an email notification. This email is very important as it contains link for account activation. 25