HIS Siemens SiPass integrated Agent

Prerequisites

• This document describes all supported versions of the agent.

• Supported PACS versions: Requirements

• A SiPass Operator is required to make all settings mentioned in this document.

• The Agent also needs to have an Operator for access the SiPass API.

• The Agent also needs to have a connection string for access the SiPass SQL Database.

Configuration

PACS Configuration

Creating the technical user

• Open SiPass integrated Configuration Client application.

• Click on Operator button and create a new one

• The User Name and Password is needed for the Agent.

• Keep the Time Schedule set to Always.

• Check the Password Never Expires .

• Click on Save button.

Workgroup - Identity

The agent needs to know a workgroup for Identity.

• Go to SiPass integrated Operation Client app.

• Go to Cardholder & Access management / Workgroup.

• Makes sure a workgroup for an Identity exists

  

Workgroup - Visit

The agent needs to know a workgroup for Visit.

• Go to SiPass integrated Operation Client app.

• Go to Cardholder & Access management / Workgroup.

• Makes sure a workgroup for an Visit exists

  

Creating technical custom fields - Identity

• Open SiPass integrated Configuration Client application.

• Click on Custom Page Designer.

• Go to Definition and add a new Textbox somewhere.

  • Set Label to e.g. External ID.

  • Set Field Name to e.g. ExternalId (without spaces). This value should be added in the Agent configuration.

  • Database.Max Length should be set to 36.

Creating technical custom fields - Visit

• Open SiPass integrated Configuration Client application.

• Click on Custom Page Designer.

• Go to Visitor Definition and add a new Textbox somewhere.

  • Set Label to e.g. External ID.

  • Set Field Name to e.g. ExternalId (should be same as for the Identity).

  • Database.Max Length should be set to 36.

PIN as a Credential support

The Agent supports PIN as Credential. The Agent needs to know a Credential Profile which should be used for PIN management.

• Go to SiPass integrated Operation Client app.

• Go to Cardholder & Access management / Credential Profile.

• Find an existing Profile with PIN Mode: PIN AS CARD or create a new one.

• Please add the Name into the Agent configuration.

SiPass API limit

By default, SiPass sets the maximum API request limit to 100 requests per minute. We recommend increasing this limit.

1. Open a file Siemens.SiPass.HR.API.Host.exe.Config located in SiPass installation in a Text editor.

2. Find a line with RateLimit_RequestCount. It looks like:

   XML

   <add key="RateLimit_RequestCount" value="100" />
   

3. Change the value to 100000. Like:

   XML

   <add key="RateLimit_RequestCount" value="100000" />
   

4. Save the file.

5. Restart the SiPass.

Agent Configuration

General agent startup

Step 1: Download

To obtain the pacs-agent_{pacs-name} Docker image, follow the HID Agent Administration Guide for End-Customer.

Step 2: Create environment

Create a file named .env with the following content:

Agent__TenantId=example-tenant-id
Agent__PacsId=example-pacs-id
Auth__ClientId=your-client-id
Auth__ClientSecret=your-client-secret

In case you are connecting to a different environment than HID production, you need to set the proper URLs:

Auth__AuthNProvider=https://auth.example.com
Agent__PlatformUrl=https://platform.example.com

Step 3: Run Docker image

docker run -d \
  --env-file .env \
  pacs-agent-{pacs-name}:latest

Step 4: Check that the Docker image is running

docker ps

Environment variables description

Related to HIS

• Agent__PlatformUrl: HID Integration Service URL (https://his.hidglobal.com/ais/v1).

  • This information is provided by HID. By default, this is set automatically to the production environment value and does not need to be set manually in most cases.

• Agent__TenantId: Tenant ID within HID Integration Service.

  • This information is provided by HID.

• Agent__PacsId: Unique ID assigned to the agent during registration.

  • This information is provided by HID.

  • If you registered your PACS on your own, this would be the ID you gave to the PACS.

Related to HID Authentication Service

• Auth__AuthNProvider: HID Authentication Service URL (https://auth-us.api.hidglobal.com/idp/t89d23e0b2445510399335/authn).

  • This information is provided by HID. By default, this is set automatically to the production environment value and does not need to be set manually in most cases.

• Auth__ClientId: Client ID obtained during registration.

  • This information is provided by HID.

• Auth__ClientSecret: Client secret obtained during registration.

  • This information is provided by HID.

Agent-specific configuration

Environment variables for SiPass:

• SiPass__Api__ServiceHrUrl: IP address or domain of SiPass integrated. E.g., https://10.154.52.188:8745/

• SiPass__Api__ServiceManagementUrl: IP address or domain of SiPass integrated. E.g., https://10.154.52.188:8744/

• SiPass__Api__UserName: Technical user’s username from creating the technical user.

• SiPass__Api__Password: Password for the username above.

• SiPass__Api__ClientId: A random string. E.g. Agent

• SiPass__Api__HrEventMessageSubscriptionTypes: List of Event Type IDs which Agent should be listening to separated by ;. E.g. 1;3;6. The list of available IDs.

• SiPass__Api__ManagementEventMessageSubscriptionTypes: List of Event Type IDs which Agent should be listening to separated by ;. E.g. 0;1. The list of available IDs.

• SiPass__Api__TimeZone: SiPass API’s time zone if it’s different than Agent is located into. The default value is the local time zone. The list of available time zones. Use ID. E.g. Pacific Standard Time.

• SiPass__Db__ConnectionString: Replace 10.154.52.188 by URL of the database server. user and password by a user with read rights to the SiPass database.
  E.g. Data Source=10.154.52.188;Persist Security Info=True;User ID=user;Password=password;Pooling=False;MultipleActiveResultSets=False;Encrypt=False;TrustServerCertificate=False;Application Name="SQL Server Management Studio";Command Timeout=0

• SiPass__Fields__ExternalIdFieldKey: The value is the Field Name from Identity Custom Field. E.g. ExternalId.

• SiPass__Fields__IdentityWorkgroupKey: Set the value from Workgroup - Identity. E.g. <Employee>

• SiPass__Fields__VisitWorkgroupKey: Set the value from Workgroup - Visit. E.g. <Visitor>

• SiPass__Fields__PinAsCardCredentialProfileName: Set the Name of a PIN AS CARD Credential Profile. E.g. PinAsCredential.

• SiPass__Fields__ActivateUserForDays: The default value how long is an Identity or Visit active in days. Use e.g. 365 for a year.

• SiPass__Fields__DefaultPicture: (Optional - the agent has a default picture set up already) The default cardholder picture is used as a placeholder when AIS deletes an existing photo. Since SiPass does not support deleting a cardholder picture directly, the agent replaces the current picture with this placeholder instead. A Base 64 String should be used, e.g. /9j/4AAQSkZJRgABAgAAYABgAAD//gAcQ3JlYXRlZCBieSBBY2N1U29mdCBDb3JwLgD/wAARCABgAGADASIAAhEBAxEB...

Agent-specific .env file part example:

SiPass__Api__ServiceHrUrl=<link-to-hr-api>
SiPass__Api__ServiceManagementUrl=<link-to-management-api>
SiPass__Api__UserName=<user-name>
SiPass__Api__Password=<password>
SiPass__Api__ClientId=<client_id>
SiPass__Api__HrEventMessageSubscriptionTypes=<list-hr-event-type-ids>
SiPass__Api__ManagementEventMessageSubscriptionTypes=<list-management-event-type-ids>
SiPass__Api__TimeZone=<time-zone>
SiPass__Db__ConnectionString=<db-connection-string>
SiPass__Fields__ExternalIdFieldKey=<external-id-field-name>
SiPass__Fields__IdentityWorkgroupKey=<identity-workgroup-name>
SiPass__Fields__VisitWorkgroupKey=<visit-workgroup-name>
SiPass__Fields__PinAsCardCredentialProfileName=<pin-as-card-credential-profile-name>
SiPass__Fields__ActivateUserForDays=<activation-length-in-days>
SiPass__Fields__DefaultPicture=<base64-picture>

Self signed HTTP SSL certificate

The Agent supports self signed (un-trusted) SSL certificate.

Agent-specific .env file can be extended by this part for example:

1. Add the self signed SSL certificate fingerprint:

   SiPass__Api__SslCertificateFingerprintSha256=<certificate-fingerprinte>
   

2. Ignore the SSL certificate completely.

   SiPass__Api__TurnOffSslVerification=true
   

Limitations

• Extension fields have to be created manually; please see the extension field setup.

• Each Credential Profile supports one related Credential per user Identity/Visit only.

• An Identity/Visit is linked to a Workgroup. The Workgroup determines which Access Units its members can access. All Identities assigned to the Workgroup automatically inherit these permissions. Note that inherited permissions are not shown directly in the Access Unit interface.

• Picture cannot be removed in the Update Identity/Visitor. A default picture is used instead.

Unsupported operations

N/A

Limited operation

Naming Mapping

Entities

Operations

Creation of extension fields

Manual for Creating an EF in the PACS - Identity

• Open SiPass integrated Configuration Client application.

• Click on Custom Page Designer.

• Go to Definition and add a new Textbox somewhere.

  • Set Label to a user friendly name.

  • Set Field Name as identifier (without spaces).

  • Set Database.Max Length to a correct value to correspond with your values.

• Click on the Save button.

Manual for Creating an EF in the PACS - Visit

• Open SiPass integrated Configuration Client application.

• Click on Custom Page Designer.

• Go to Visitor Definition and add a new Textbox somewhere.

  • Set Label to a user friendly name.

  • Set Field Name as identifier (without spaces).

  • Set Database.Max Length to a correct value to correspond with your values.

Supported entities and data types

Additional information

Hr Event Message Subscription Types

Management Event Message Subscription Types

Time Zones