4.4 Editing a PIV applicant

The Edit PIV Applicant screen works in the same way as the Edit Person screen does for non-PIV applicants (see section 4.3, Editing a person), but has the following additional tabs:

• STATUS
• POSITION
• SPONSOR
• APPLICATION
• BIOMETRICS

For more information about PIV attributes, see the Editing PIV applicants section in the PIV Integration Guide.

To edit a PIV applicant:

1. Search for a person, and view their details.

   See section 4.1, Searching for a person for details.

   You can also view a person's details from any form that contains a link to their account.

   For example:

   • Click the link icon on the Full Name field of the View Request form.
   • Click the link icon on the Owner field of the View Device form.

2. Click the Edit PIV Applicant option in the button bar at the bottom of the screen.

   You may have to click the ... option to see any additional available actions.

3. Update the person's details.

4. Click SAVE.

4.4.1 Setting the person's status

On the STATUS tab of the Edit PIV Applicant screen, you can see the following options:

• User Data Approved – certifies that the applicant has been through the correct enrollment process and has been approved to receive a PIV card.

• Vetting Date – the date the person passed their identity checks.

  For more information on setting the User Data Approved and Vetting Date options, see section 4.11, Approving user data.

• Maximum credential expiry date – optionally, specify the latest expiry date for any device issued to this person.

  This setting affects all future device requests. It does not affect any issued devices or existing requests.

  See section 4.8, Requesting a device for a person for details.

  Note: This setting affects device requests made through the MyID Operator Client only. Requests made through MyID Desktop or the Lifecycle API do not take this setting into account. Note, however, that if you specify an explicit expiration date when requesting a device using MyID Desktop, an error appears if that date exceeds the Maximum credential expiry date set for the person. If you do not specify an explicit expiration date, MyID Desktop ignores the Maximum credential expiry date altogether.

  You can also set this date using the MaxRequestExpiryDate option in the Lifecycle API. See the Lifecycle API guide for details.

• NACI Status – records the status of the NACI check.

  Note: You must use this only in accordance with FIPS 201-2 guidelines. For PIV-I and CIV, set this to Not Requested.

4.4.2 Providing the person's position details

On the POSITION tab of the Edit PIV Applicant screen, set the following details:

• Privilege – select the applicant's privileges from the list. This is agency-specific data that can be printed on the card.

• Affiliation – the cardholder's role or position within the organization; for example, Contractor or Emergency Responder.

• Agency Association – indicates how the cardholder is associated to the agency; for example, Employee or Contractor. These options are defined by FIPS 201.

• Department – the department’s name within the agency.

• Agency – the group name from the Personal tab.

• Position – the position of the applicant within the agency.

• Rank – the rank of the applicant.

• Emergency Role – the specific role in the event of an emergency of the applicant, if any.

• Additional Information – contains any extra information about the applicant's position.

• PIV DN – the distinguished name for the user.

  The operator must enter the PIV DN manually. If you require MyID to generate the distinguished name for PIV applicants, contact Intercede for further guidance, quoting SUP-335.

4.4.3 Providing the details of the person's sponsor

On the SPONSOR tab of the Edit PIV Applicant screen, set the following details:

• Name – the name of the person sponsoring the applicant.
• Position of sponsor – the position of the sponsor.
• Email of sponsor – the email address of the sponsor.
• Agency of sponsor – the agency to which the sponsor belongs.
• Phone – the phone number of the sponsor.

4.4.4 Providing the person's application documents

On the APPLICATION tab of the Edit PIV Applicant screen, you can provide details of the following documents for the person:

• SF85 or OPM document
• Two identity documents

Note: You can scan identity documents using the MyID Operator Client; see section 4.6, Scanning documents. Alternatively, you can use the Lifecycle API, or the Edit PIV Applicant workflow in MyID Desktop to scan or upload the documents.

Complete the following details for the person:

• Nationality – select the country of the person's nationality from the drop-down list.
• Country of Birth – select the country where the person was born from the drop-down list.
• Applicant's Place of Birth – for people born in the United States, select the state, district, or territory. For people born outside the United States, this is automatically set to the same value as the Country of Birth.

For each identity document, provide the following details:

• Title – select the document type. Only documents of the types listed are acceptable as proof of identity.

• Issued by – enter details of the organization that issued the document.

• Number – the document's serial number.

• Expiration – the expiration date of the document.

• The Capture Date is populated automatically when you use the Edit PIV Applicant screen in the MyID Operator Client or the Edit PIV Applicant workflow in MyID Desktop to capture the identity documents – if you import the documents using the Lifecycle API, this date is not captured.

Fingerprints

You can capture fingerprints for the person. If the person has already had fingerprints captured, they are indicated on the Fingerprints control. If the person already has fingerprints captured, you can still capture their fingerprints; any additional fingers are added to their record, and any updated fingerprints replace the fingerprints stored in the database.

To capture fingerprints:

1. Click CAPTURE FINGER.

   The fingerprint dialog appears:

   

2. Select the fingers you want to capture.

3. Click CONFIRM.

   The fingerprint capture dialog appears. Follow the on-screen instructions to capture each fingerprint.

   Note: The Account for missing fingerprints and Enforce a minimum number of fingerprints during enrollment? options are not enforced when capturing fingerprints using the MyID Operator Client.

Note: Once you have captured the fingerprints, the newly-captured fingerprints are indicated on the capture control on the BIOMETRICS tab; previously-captured fingerprints are not indicated until you exit the Edit PIV Applicant screen and re-enter it.

Facial biometrics

For information on capturing facial biometrics, see section 4.7, Capturing facial biometrics.

4.4.6 Considerations

The Edit PIV Applicant screen in the MyID Operator Client does not work in exactly the same way as the Edit PIV Applicant workflow (which was available in MyID Desktop in previous versions of MyID). There are some differences and limitations:

• Association text is not printed on cards.

  This is a known issue. The person's Agency Association code is stored in the database, but the text description is not saved.

• Changing a person's group does not affect their PIV DN or Department.

  If you change a person's group, you must update these fields manually.

• The person's PIV DN does not change automatically.

  If you change the person's name, nickname, or Agency Association, you must update the PIV DN field manually.

• The Allow duplicate DN does not affect the PIV DN.

• There is no relationship between fields on the system tab and person's MyID logon name. If there are changes required to keep them synchronized, you must apply this manually. This does not occur where directory synchronization is used.

• The Account for missing fingerprints configuration option is not supported in the MyID Operator Client.
• Unlike in MyID Desktop, you do not need to have the PIV Applicant Editor role to edit PIV attributes in the MyID Operator Client; if your role has access to the Edit PIV Applicant option in the Edit Roles workflow, you can edit PIV attributes.
• The Association and Rank fields were automatically populated with default values in MyID Desktop, but not in the MyID Operator Client.
• You cannot scan identity documents in the MyID Operator Client.
• In MyID Desktop, the PIV Applicant role was added to a person if you used the Edit PIV Applicant workflow to import them from a directory. There is no equivalent process in the MyID Operator Client; instead, you can set the default roles for the group to which you are adding the user to include the PIV Applicant role.
• Changing the NACI Status to Rejected does not carry out any further revocations.

There are some differences in the field names between the MyID Operator Client and MyID Desktop:

MyID Desktop	MyID Operator Client
Security	Employee ID
Address 1	1st line of Address
Address 2	2nd line of Address
Association	Agency Association
Extra Info	Additional Information
Birth Country	Country of Birth
Place of Birth	Applicant's Place of Birth
Race	Racial origin of cardholder
Iris Captured	Iris Status
[Sponsor] Position	Position of sponsor
[Sponsor] Email	Email of sponsor
[Sponsor] Agency	Agency of sponsor

4.4.7 Adding PIV applicants from a directory

You can use the Edit Person (Directory) screen to add a new user from a connected LDAP.

Note: If you have the Edit Directory Information configuration option (on the LDAP page of the Operation Settings workflow) set to No, you will be unable to edit any of the person data that is mapped to the directory. The default is Yes.

The user must belong to an LDAP group that is mapped to an existing MyID group, and the Search a Directory option (on the LDAP page of the Operation Settings workflow) must be set to Yes or Ask.

If you use click the EDIT PERSON button on the View Person (Directory) screen to select a user who is not already in the MyID database, the user is imported, given the Cardholder and Password User roles, and assigned to the group that matches their LDAP group. If you want the person to be a PIV applicant, add the PIV Applicant role to their list, and click SAVE. You can then use the Edit PIV Applicant screen to edit the user's details as normal.

To add PIV applicants from a directory, you must set up the groups in MyID before you begin:

• Both the LDAP group the PIV applicant belongs to, and the parent LDAP group, must have been imported from LDAP into MyID. The hierarchy between the group the user belongs to and the parent group must be the same in both MyID and the LDAP. There are various ways to achieve this:

  • In the Edit Groups workflow, select Import LDAP Branch/OU and children to import a group above the group the user belongs to.

    This will ensure that the hierarchy of the group and parent group is consistent in both MyID and LDAP.

  • Alternatively, you can create the parent group first, then import the group the user belongs to as a child of the parent group.

  • If this hierarchy of group and parent group is not set up correctly, you will see the following error when trying to import users from LDAP in the Edit PIV Applicant workflow:

    Target is not associated with a MyID group

• Additionally, you must ensure that the PIV attributes have been configured for the group that the MyID user belongs to; you can do this using the Amend Group workflow.

• The logged on user must have the PIV Applicant Editor role and access to the Edit Person and Edit PIV Applicant screens to import users from LDAP using the Edit Person (Directory) screen.