13.4.1 Administration Guide

The Administration Guide has been updated with the following:

• Information about new PIN generation features.

  See the PIN generation section.

• Added the new Use PIN policy settings in random server PIN generation configuration option.

  See the PINs page (Security Settings) section.

• Added the new Use Global PIN credential profile option.

  See the PIN Settings section.

• Added the new Verify Fingerprints During Card Update and Verify Fingerprints During Reset PIN credential profile options.

  See the Issuance Settings section.

• Added information on capturing client IP address and identifier in the audit trail.

  See the Logging the client IP address and identifier section.

• Added configuration options for the client IP address and identifier.

  See the Server page (Security Settings) section.

• Added the new Update email address from derivation configuration option.

  See the Certificates page (Operation Settings) section.

• Updated the details of support for additional identities on PIV devices.

  See the Additional identities on devices with PIV applets section.

• Added details of the Issue over Existing Credential credential profile option.

  See the Issue over Existing Credential section.

• Added a note that the Use Entrust default key update policy configuration option is not relevant for the Entrust CA Gateway.

  See the Certificates page (Operation Settings) section.

• Clarified which operations are permitted with key recovery cards.

  See the Key recovery section.

13.4.2 Advanced Configuration Guide

The Advanced Configuration Guide has been updated with the following:

• Updated schedules for expiring items warnings.

  See the Monitoring the expiry of system credentials section.

13.4.3 Configuring Logging

The Configuring Logging document has been updated with the following:

• Combined the sections on logging the Windows clients (MyID Desktop, Self-Service App, Self-Service Kiosk, and MyID Client Service) into a single section as they now use the same configuration to set up logging.

  See the Windows clients section.

13.4.4 Derived Credentials Self-Service Request Portal

The Derived Credentials Self-Service Request Portal guide has been updated with the following:

• Details of the doNotUpdateUser attribute, which allows you to control whether a specified role is added to an existing user or is used only for filtering credential profiles.

  See the Configuration file format section.

• Added the new Update email address from derivation configuration option.

  See the MyID configuration options section.

• Added information about configuring email notifications.

  See the Configuring email notifications section.

• Added details of the Issue over Existing Credential credential profile option.

  See the Creating an Identity Agent credential profile section.

13.4.5 Entrust CA Gateway

The Entrust CA Gateway Integration Guide has been updated with the following:

• Note on not passing subject DN components through policy attributes.

  See the Enabling certificate policies section.

• Additional information about using the Reverse DN option.

  See the Enabling certificate policies section.

• Added utf8 as an encoding option for policy extended attributes, and updated the example for User Principal Name to use this encoding.

  See the Adding policy extended attributes section.

• Added information on controlling certificate lifetimes, including the limitation that the minimum lifetime is seven days.

  See the Controlling certificate lifetimes and Limitations sections.

• The Key Algorithm and Key Purpose fields are now read-only, and obtain their value from the options configured for the policy on the CA.

  See the Enabling certificate policies section.

13.4.6 Entrust CA Integration Guide

The Entrust CA Integration Guide has been updated with the following:

• Updated the supported version numbers.

  See the Supported Entrust versions section.

13.4.7 Entrust nShield HSM Integration Guide

The Entrust nShield HSM Integration Guide is the new name for the nCipher nShield HSM Integration Guide.

13.4.8 Error Code Reference

The Error Code Reference has been updated with the following:

• Updated MyID Operator Client error wording and possible solutions.

  See the MyID Operator Client error codes section.

• Added new error codes related to requesting device updates:

  • WS40044 – There are no status mappings available for the selected operation.

  • WS40045 – The device cannot be updated because it has already expired.

  • WS40046 – The device cannot be updated because the issuance process has not been completed.

  • WS40047 – The device cannot be updated because it does not have a credential profile.

  • WS50052 – The device owner has a maximum expiry date that is earlier than the expiry date of the device. The update cannot be requested because the credential profile does not have Ignore User Expiry Date set.

  • WS50053 – The capabilities of the selected credential profile are not supported by this operation.

  • WS50054 – The selected credential profile has different capabilities to the current device credential profile.

  See the MyID Operator Client error codes section.

• Added a new error code related to biometric authentication:

  • 800630 – Biometrics are required.

  See the Web Service error codes section.

13.4.9 Implementation Guide

The Implementation Guide has been updated with the following:

• Updated the locations of the System Interrogation Utility (SIU) and Server Diagnostic Report (SDR), as they have been incorporated into the MyID Installation Assistant.

  See the System Interrogation Utility and Server Diagnostic Report Utility sections.

13.4.10 Installation and Configuration Guide

The Installation and Configuration Guide has been updated with the following:

• Added information on using the MyID Installation Assistant.

  See the MyID Installation Assistant, Running the installation program, Running the update installation program, and Upgrading MyID sections.

• The installation user must have a default schema of dbo in SQL Server if you are installing to an existing database.

  See the Installation account section.

• Recommendation to keep .NET Core updated with security releases from Microsoft, and a known issue where the .NET Core Desktop Runtime versions 6.0.1 and 6.0.2 cause a problem with the MyID Client Service.

  See the Additional hardware and software requirements section.

• Removed the following entry from the list of required Windows features for the web server:

  • Web Server (IIS)\Management Tools\Management Service

  See the Setting up Windows server roles and features section.

• Updated the list of supported client operating systems.

  See the Operating systems section.

• Added a new requirement to install the .NET Runtime package on the MyID application server.

  See the Additional hardware and software requirements section.

• Updated the tested version of the Microsoft OLE DB Driver to 18.6.3.

  See the Installing the database software section.

• Added instructions on upgrading to a new server.

  See the Upgrading to a new server section.

13.4.11 Mobile Identity Management

The Mobile Identity Management guide has been updated with the following:

• Added information on creating a custom PKCS #10 request.

  See the Setting up a custom PKCS #10 request section.

• Updated the list of supported MDMs.

  See the Supported Mobile Device Management integration section.

• Added information about integration with MDMs.

  See the Setting up your MDM system section.

13.4.12 MyID Core API

The MyID Core API guide has been updated with the following:

• Information about providing a client identifier in the http header.

  See the Providing a client identifier section.

• Added information on configuring the API documentation to display the permissions that provide access to each API call.

  See the Accessing the API documentation and Accessing the API features sections.

13.4.13 MyID Operator Client

The MyID Operator Client guide has been updated with the following:

• Information about collecting updates for another person's device.

  See the Collecting updates for another person's device section.

• Added details of the MyID Desktop administrative workflows you can launch from the new More category within the MyID Operator Client.

  See the Launching administrative workflows section.

• Added details of the Request Update option on the View Device screen.

  See the Requesting an update for a device section.

• Added a known issue where the .NET Core Desktop Runtime versions 6.0.1 and 6.0.2 cause a problem with the MyID Client Service.

  See the .NET Core Desktop Runtime versions section.

• Added details of launching the Authenticate Person workflow from the View Person screen.

  See the Authenticating a person section.

• Added details of launching the Change Security Phrases and Unlock Security Phrases workflows from the View Person screen.

  See the Working with security phrases section.

• Added details of launching the Manage Additional Identities workflow from the View Person screen.

  Note: This feature has been superseded in MyID 12.7 by the additional identities features added to the MyID Operator Client; see the Working with additional identities section.

• Added details of launching the Print Badge workflow from the View Person screen.

  See the Printing a badge section.

• Added details of launching the Deliver Card workflow from the View Request screen.

  Note: This feature has been superseded in MyID 12.7 by the Accept Delivery feature; see the Accepting delivery for a device section.

• Added details of launching the Manage VSC Access and Unlock VSC Temporary Access workflows from the View Device screen.

  See the Managing VSCs section.

• Added details of launching the Reinstate Card workflow from the View Device screen.

  See the Reinstating a device section.

• Added details of launching the Card Disposal workflow from the View Device screen.

  See the Disposing of a device section.

• Added details of launching the Print Mailing Document workflow from the View Device screen.

  See the Printing a mailing document section.

• Added details of launching the Change PIN workflow from the View Device screen.

  See the Changing a device PIN section.

• Added troubleshooting information for issues relating to launching MyID Desktop or the Self-Service App.

  See the Troubleshooting MyID Client Service connection issues section.

• Added information on using the self-service menu.

  See the Carrying out self-service operations section.

• Added information on the Mobile Devices report.

  See the Mobile Devices report section.

• Updated the table of Edit Roles options mapping to MyID Operator Client features.

  See the Roles and groups section.

13.4.14 Operator's Guide

The Operator's Guide has been updated with the following:

• Information about using the Collect Updates workflow to collect updates for another person's device.

  See the Collect Updates workflow section.

• Added a note about the behavior of the Card PIN authentication method in the Reset Card PIN workflow in relation to server-generated PINs.

  See the Resetting a card's PIN section.

13.4.15 Printer Integration Guide

The Printer Integration Guide has been updated with the following:

• Added a note that you must not connect the printer before being prompted when installing the Entrust Datacard printer driver.

  See the Entrust printers section.

13.4.16 PrimeKey EJBCA Integration Guide

The PrimeKey EJBCA Integration Guide has been updated with the following:

• Removed requirement to set the Batch Generation option.

  See the Configuring end entity profiles and Key escrow policy configuration overview sections.

• Generating subject DNs for EJBCA certificate requests.

  See the Configuring end entity profiles and Key escrow policy configuration overview sections.

• Added further details of the behavior of the Reverse DN option.

  See the Enabling certificates policies on a CA section.

13.4.17 Reporting Web Service API

The Reporting Web Service API guide has been updated with the following:

• Updated instructions on client certificate mapping for 2-way SSL.

  See the Enabling 2-way SSL section.

13.4.19 Smart Card Integration Guide

The Smart Card Integration Guide has been updated with the following:

• Support for the IDEMIA ID-One PIV 2.4.2 on Cosmo V8.2 smart card has been extended to include the BAP#087583 configuration, which provides support for Global PIN.

  See the IDEMIA smart cards and Global PIN support sections.

• Support for YubiKey devices has been enhanced to provide support for PIV PUK and Configuration Lock Code keys, updated key settings for YubiKey SC and YubiKey SC FIPS devices, and configuring device capabilities.

  See the Setting up the PIV PUK key, Setting up the Configuration Lock Code, Cryptographic keys for Yubico cards, and Enabling and disabling device capabilities sections.

• Support for IDPrime MD830nc smart cards has been added.

  See the Thales authentication devices section.

• Updated the details of support for additional identities on IDEMIA PIV cards.

  See the Additional identities for IDEMIA PIV cards section.

13.4.20 System Interrogation Utility

The System Interrogation Utility guide has been updated with the following:

• Added new test SIU-321, which checks that .NET Core has been installed after IIS.

  See the Description of derived tests section.

• Added new test SIU-322, which provides a warning if CRL checks are required but there is no Internet access.

  See the Description of derived tests section.