16 Known issues

This section contains known issues with MyID. These are issues that have been found across both editions of MyID – Enterprise and PIV – and may not all be relevant for your system.

• IKB-15 – Problems collecting or updating cards

  If you experience problems when collecting or updating cards, try increasing the Certificate Refresh Threshold option on the Certificates tab of the Operation Settings workflow to a higher value; for example, 45.

  This problem may manifest with an error similar to:

  One of the certificates that have been requested for you has failed to issue. Please contact your administrator.

  Note that the certificate may have issued correctly even though the card update has failed.

• IKB-16 – Pressing back shortcut key causes blank screen

  As many MyID workflows are based on web pages, and MyID Desktop embeds a browser control to display these workflows, you may experience problems if you attempt to use the browser's controls to go back; for example, pressing ALT + left arrow or pressing Backspace when not editing a field. These browser controls cannot be overridden.

  Typically, the problem presents itself as a blank screen.

  If this happens, click the Home button and restart the workflow.

• IKB-20 – Pressing refresh (F5) causes blank screen

  As many MyID workflows are based on web pages, and MyID Desktop embeds a browser control to display these workflows, you may experience problems if you attempt to use the browser's controls to refresh the screen using the F5 key.

  Typically, the problem presents itself as a blank screen.

  If this happens, click the Home button and restart the workflow, or close MyID Desktop and restart.

• IKB-27 – Cannot click on links in email notifications

  There is an issue with links being removed from email messages. This may occur with emails received through Outlook Web Access or on some mobile mail clients. In some cases, Microsoft Exchange may remove hyperlinks from messages.

  For more information, contact Intercede customer support quoting reference SUP-176.

• IKB-35 – OTP fails to validate if security phrases are locked

  If you attempt to validate a job OTP (for example, a logon code, or a challenge code for SCEP issuance) but the user's security phrases are locked, the validation will fail.

  As a workaround, unlock the user's security phrases using the Unlock Security Phrases workflow before attempting to validate the OTP.

• IKB-80 – Cannot activate a card that has been reinstated when it was issued using 1-Step pre-encoding

  If you have issued a card using the 1-Step option for Pre-encode Card in the credential profile, then use Reinstate Card, you cannot proceed to activate the card; the card is not recognized as being ready for activation.

  As a workaround, you must cancel and re-issue the card.

• IKB-81 – Cannot click on links in email notifications

  You can configure MyID to notify users by email that a mobile identity is available for them to collect. There is an issue with some email servers where they remove links from email messages before sending the message to mobile clients, which stops the email notification link from being used to start Identity Agent to collect the mobile identity. Additionally some email clients can also remove the link even if it has been provided in the email from the server. For more information, contact Intercede customer support quoting reference SUP-176.

• IKB-84 – Cannot use the Request Replacement ID workflow with Identity Agent-based credential profiles

  The Request Replacement ID workflow allows you to request a replacement ID for a user where the mobile device may have been lost or stolen. If the credential profile used to issue the mobile ID had the Identity Agent (Only) option selected, you cannot use this workflow; an error appears in MyID when you attempt to request a replacement ID.

  As a workaround, you can cancel the mobile credential using the Cancel Credential workflow, then request a new mobile identity for the user.

• IKB-88 – Existing mobile credentials overwritten

  When using Identity Agent-based credential profiles, if you request a mobile identity for a user, the new identity overwrites the existing identity; the original identity is canceled in MyID, but the certificates remain issued.

• IKB-118 – Issue when using MyID Desktop with JAWS

  You may experience an intermittent problem when using the JAWS screen-reading software (version 12 and later): MyID Desktop may become unresponsive when you open the New Action dialog, depending on the number of available workflows.

• IKB-182 – Mobile devices with multiple keystores show one entry, but cancel all

  When canceling credentials on a mobile device, the search results display a single entry that represents the primary keystore on the device. Where the device has been issued with multiple keystores, all the associated certificates will be canceled.

• IKB-215 – Software certificate renewals use the original credential profile settings

  The content of software certificate packages is determined by a credential profile. When renewing software certificates, changes to the certificate policies assigned to the credential profile will not be picked up – the policies defined in the original version of the credential profile will be used. If a certificate policy has been superseded, the replacement policy will be used automatically.

• IKB-219 – Contactless card detection

  There are some differences between the Issue Card workflow and the updated Collect Card and Batch Collect Card workflows.

  With Issue Card, you cannot issue a dual-interface (contact chip and contactless) smart card unless it has been previously imported to the system using the Import Serial Numbers workflow, or it has been previously issued as a dual-interface smart card using Collect Card. Unknown dual-interface cards are not supported. Contactless-only cards require the credential profile to be set as Must be a Proximity Card when used with Issue Card.

  If you require Contactless-only card issuance to be restricted to known devices only (to enforce the credential profile setting Must be a known Proximity Card), or require information to be sent to a PACS, the card details must be imported separately. Contact customer support quoting reference IKB-219 for assistance.

• IKB-236 – Differences in PIN policy between Change PIN and Reset PIN workflows

  You can set the PIN Policy for smart cards within the credential profile. If you change the PIN policy in the credential profile after issuing a card, the Change PIN workflow, and older web-based workflows (Unlock Card, Auto Unlock Card) will continue to use the PIN policy set at the time the card was issued.

  The Self-Service Kiosk, the Reset Card PIN workflow, and self-service Reset PIN feature in MyID Desktop will use the PIN policy from the latest version of the credential profile, allowing PIN policy to be changed at any time. During any issuance process, the PIN policy is always taken from the latest version of the credential profile.

  If you need to modify your PIN policy and are affected by this issue, contact customer support quoting reference SUP-284.

• IKB-247 – Problem with transaction locking smart cards

  When MyID clients interact with smart cards or tokens that present a smart card interface, a transaction lock to the card takes place to prevent other software from interrupting any processing that MyID is carrying out.

  Some actions in Windows, typically involving authentication (for example, locking the Windows logon session using ctrl-alt-delete, or starting an application such as Task Manager that requires administrator authentication with a smart card) that take place while a MyID client is accessing the smart card may result in Windows being unable to access the card.

  This could cause issues such as preventing the user from unlocking the computer again. Removing the smart card from the reader or waiting for the Windows operation to time out will overcome the problem.

• IKB-251 – Revoking certificates outside MyID may cause errors

  MyID provides a management interface to certificate authorities and controls the issuance and revocation process of certificates. If the status of a certificate issued by MyID is changed on the certificate authority (for example a certificate is revoked) MyID will not be aware of the status change of the certificate, so subsequent attempts to revoke the certificate may fail. Depending on the type of certificate authority, the nature of the failure may be different. Failures to revoke certificates will be reported in the System Events and Audit Reports workflow.

• IKB-268 – Automatic Update Collection configuration option is amended on upgraded systems

  If you have upgraded an existing system, check the value of the Automatic Update Collection configuration option on the Issuance Processes page of the Operation Settings workflow. This option controls which workflows run automatically at logon if the user has a pending job. The upgrade process changes this value to 2,245;2,255 – you must check that this is appropriate and revert it to its previous value if necessary. The default value for PIV systems is 2,245.

• IKB-291 – Cannot use smart card after updating to Elliptic Curve (ECC) certificates

  If you attempt to update a smart card to change from using certificates with RSA Key Pairs to Elliptic Curve certificates, the card will not be usable after the update process has completed.

  This will occur if you use the Update Card or Collect My Updates workflows, or collect the update using the Self-Service App.

  An alternative method to replace all certificates is to use the Reprovision Card or Reprovision My Card workflow, or request a card update using the following reason:

  • New credential profile needs to be applied

  which creates a reprovision request to be collected using the Self-Service App.