Integrate Imprivata Enterprise Access Management

Configure API Access to EAM using the Imprivata Admin Console.

To configure the API access:

1. Log into the Imprivata Admin Console and go to the gear icon > API Access.

2. Under ProveID – API access and security, select Allow full access via ProveID Web and ProveID Embedded.

   Click to enlarge

   

3. Select the API access needed for the OS of your devices:

   1. For iOS devices, select the Imprivata Mobile for iOS checkbox.

   2. For Android devices, select both the Imprivata Mobile for iOS and the Imprivata Mobile for Android items.

4. Click Save.

Mobile Access Management organizations that use EAM as the Identity provider create a host (computer) in EAM for every Launchpad. Each computer receives a computer policy that must allow proximity card authentication to support checkout using a tap.

In the Imprivata Admin Console, verify that no override is configured in the computer policy assigned to the Launchpads.

1. Confirm that there is no override in the computer policy that the Launchpads are assigned to.

   If Launchpads are assigned to the Default Computer Policy, no changes are required.

2. Verify that mobile devices are correctly assigned:

   • MAM devices appear as ProveID Web devices in the Imprivata Admin Console.

   • Confirm that these devices are assigned to the Default Computer Policy. If they are assigned to the Default Computer Policy, no changes are required.

3. Verify user policy configuration:

   • Confirm that the user policies assigned to mobile users allow proximity cards as a primary authentication factor.

4. Review the results:

   • If all conditions above are met, no configuration changes are required.

Modify the Computer Policy (If Required)

If a computer policy override is already enabled for Launchpads:

1. In the Imprivata Admin Console, open the applicable computer policy.

2. In Override and Restrict tab > Desktop Access Authentication Restrictions section, verify that Proximity Card is allowed within the override settings.

3. If proximity card authentication is not allowed for your organization or cannot be otherwise enabled:

   1. Create a separate computer policy.

   2. Assign Launchpads and associated devices to the new policy.

      

Next Steps

• If you made changes to computer policies, complete the required updates before proceeding.

• If no changes are required, skip to the Configure Second Factor Grace Periods section.

Depending on the authentication methods defined in the EAM user policy and computer policy, ensure that you have configured the appropriate grace periods for the second authentication factor.

For example, when using proximity cards as the second authentication factor, you can set a grace period for the second authentication factor after successful authentication, up to 24 hours 59 minutes.

The settings are available in the Authentication method options section of the Authentication tab of the Imprivata Admin Console.

Ensure that you have configured the user policy to allow the users to enroll at least two (2) proximity cards.

The settings are available in the Authentication method options of the Authentication tab under Proximity card.

1. Set the Specify the number of cards a user is allowed to enroll to Allow 2 cards.

2. Specify the grace period for second authentication factor as appropriate.

3. Optionally, select Allow users to enroll a replacement card.

4. Save the user policy.

In the MAM console, configure the integration with Imprivata Enterprise Access Management:

1. In the MAM console, go to Admin > Check Out.

2. In the Check Out section, switch the setting to ON.

3. In the Identity Provider section, select Imprivata Enterprise Access Management from the list and click Configure.

   

4. In the dialog, in the Imprivata appliance hostname box, type the hostname of your Imprivata appliance.

   IMPORTANT:

   Use the FQDN when specifying the Imprivata appliance hostname.

   DNS names ending in '.local' are not supported.

   

5. If your organization uses a root certificate authority, upload that CA certificate to this dialog, in PEM, CER, CRT, or DER format. Otherwise leave Disable SSL checks selected. Click Save.

6. Restart any Launchpads as prompted.

   To test this configuration, in the MAM console, click the Launchpads tab, then open one of your Launchpads. In Launchpad Actions, select Test Identity Web Service.

About Certificates

Certificates are not required for Check Out or Password AutoFill Workflows. But if your organization would like to enable SSL trust certificates, these requirements must be met:

1. As per Apple’s trust certificate requirements, certificates must have a validity period of 825 days or fewer. If the certificate applied to EAM has a longer validity, it will be need to be updated at the Imprivata appliance level first.

   After that change has been made, follow the instructions below to obtain the root certificate for use in Mobile Access Management.

   See EAM's documentation on how to update certificates on the Imprivata appliance.

2. Mobile Access Management requires a root certificate (self signed or issued by a CA authority).

   1. Use any web browser to download the root certificate from the appliance. Make sure you are downloading the Root certificate, not the certificate installed on the Imprivata appliance.

   2. Upload this certificate this certificate to Mobile Access Management.

NOTE:

The Launchpad caches the Imprivata appliance list the first time it connects to EAM.

• It updates the list periodically, failing over to other available appliances when one is offline, and clears the list when the MAM server configuration is changed.

• The Launchpad caches user badge tap authentications for seven (7) days. If the Imprivata appliances are not reachable (they are offline for maintenance), the Launchpad uses the cached information to complete the check out.

  To change the default behavior of the Launchpad badge tap caching, contact Imprivata Support.