Skip to content

Credential Issued

For people who are created in AEOS rather than in VisitorPass — typically your own workforce. When someone is created in AEOS, the integration invites them to VisitorPass. Once they have accepted and their credential is issued, VisitorPass calls the integration, which records their consent in AEOS and gives their carrier its badge.

This is the only capability VisitorPass calls the AEOS server for.

Requirements

  • Connection 3 in the network requirements: TCP 8888 from VisitorPass to the AEOS server.
  • An AEOS user that can create free fields and change user roles.

Prepare AEOS

  1. In the AEOS web client, open Administration → Maintenance → Free fields → Free field categories and make sure a category exists for carrier type Employee.
  2. Open Administration → Maintenance → Free fields → Free fields → New and create gdpr_consent with Data type Yes/No.

  3. Add these functions to the VisitorPass integration role:

    Function (English UI) Danish UI
    Person, Employee, Search Person, Medarbejder, Søg
    Person, Employee, Announce Person, Medarbejder, Opret
    Person, Employee, Issue identifier Person, Medarbejder, Udsted ID-nøgle

  4. Open Management → Maintain user role → VisitorPass integration → Configuration and set gdpr_consent to Edit value: Read/write.

Prepare the service

  1. Copy the keystore for this host, webhook-keystore.p12, into conf\. Partisia issues it from its own certificate authority for the AEOS server's host name, and sends it with its password.

    Partisia staff

    PRODUCTION.md in the visitorpass-aeos-integration repository › Credential Issued › Issue the keystore

  2. Look up the id of the gdpr_consent field — the <Id> of the definition named gdpr_consent:

    '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sch="http://www.nedap.com/aeosws/schema"><soapenv:Body><sch:FreeFieldDefinitionSearchInfo/></soapenv:Body></soapenv:Envelope>' | curl.exe -s -k -u '<soap-user>:<soap-password>' -H 'Content-Type: text/xml; charset=utf-8' -H 'SOAPAction: ' --data-binary '@-' https://localhost:8443/aeosws

Configure the service

Add a credentialIssued section to server.json, beside the sections from the installation. The section turns Credential Issued on: the service then listens on port for VisitorPass, and checks AEOS for new people.

server.json
  "credentialIssued": { // (1)!
    "port": 8888, // (2)!
    "keyStore": "conf/webhook-keystore.p12", // (3)!
    "keyStorePassword": "<keystore-password>",
    "webhookSecret": "<webhook-secret>", // (4)!
    "gdprConsentDefinitionId": <gdpr-consent-id>, // (5)!
    "requiredTemplateIds": [<authorisation-template-id>], // (6)!
    "invitation": { // (7)!
      "apiKey": "vp_<organisation-api-key>", // (8)!
      "hostEmail": "<host-employee-email>", // (9)!
      "purpose": "Worker GDPR consent", // (10)!
      "templateId": "<visit-template-id>", // (11)!
      "visitDurationHours": 8760 // (12)!
    }
  },

  1. Detection of new people in AEOS, and the call VisitorPass makes once their credential is issued.

    On first start the service invites only people created or changed from then on. People already in AEOS are not invited.

    The service checks AEOS every 30 seconds. delayMillis sets another pause, in milliseconds.

  2. The port VisitorPass calls the service on: connection 3 in the network requirements.

    Value: 8888, or another free port. Not 8443, which AEOS uses.

  3. Lets VisitorPass call the service over HTTPS on port.

    Value: the keystore from step 1, and the password Partisia sent with it.

  4. The secret VisitorPass signs its calls into the service with.

    Value: Partisia subscribes this server to credential-issued events in VisitorPass, with a new secret, and sends you the secret.

  5. The id of the gdpr_consent free field, from step 2.

  6. The AEOS authorisation templates whose holders are invited, for example white collar.

    Value: the template ids, from the AEOS id column under AEOS templates on the AEOS page in VisitorPass. Click Refresh from AEOS first if the list is empty. An empty list invites everyone created in AEOS.

  7. The invitation each new person receives in VisitorPass.

  8. An API key for your organisation in VisitorPass.

    Value: an administrator creates it in the VisitorPass dashboard under Settings → API keys. It is shown only once, when it is created.

  9. The employee named as host on the invitation. It must exist in VisitorPass.

  10. The purpose of the visit, shown on the invitation.

  11. The VisitorPass visit template the invitation uses.

    Value: an administrator finds it in the dashboard under Templates: open the template, and the id is the last part of its address.

  12. How long the invitation stays valid, in hours. 8760 is a year.

Partisia staff

PRODUCTION.md in the visitorpass-aeos-integration repository › Credential Issued › Subscribe to credential-issued events for credentialIssued.webhookSecret

Restart the service:

.\servy\servy-cli.exe restart --name visitorpass-aeos-integration

Verify

  1. Check that the service now listens for VisitorPass. The line reads Listening on https://0.0.0.0:8888/:

    Select-String -Path logs\out.log -Pattern 'Listening on' | Select-Object -Last 1

  2. Create a test person in AEOS who holds one of requiredTemplateIds, with an email address. Within a minute the service invites them:

    Select-String -Path logs\out.log -Pattern 'Initiated issuance' | Select-Object -Last 5

  3. Accept the invitation from the test person's phone, and check that consent was recorded:

    Select-String -Path logs\out.log -Pattern 'Recorded GDPR consent','Assigned badge' | Select-Object -Last 5

  4. Check in the AEOS web client that gdpr_consent is set on the test person.