Credential Issued

For people who are created in AEOS rather than in VisitorPass — typically your own workforce. When someone is created in AEOS, the integration invites them to VisitorPass. Once they have accepted and their credential is issued, VisitorPass calls the integration, which records their consent in AEOS and gives their carrier its badge.

This is the only capability VisitorPass calls the AEOS server for.

Requirements

• Connection 3 in the network requirements: TCP 8888 from VisitorPass to the AEOS server.
• An AEOS user that can create free fields and change user roles.

Prepare AEOS

1. In the AEOS web client, open Administration → Maintenance → Free fields → Free field categories and make sure a category exists for carrier type Employee.
2. Open Administration → Maintenance → Free fields → Free fields → New and create gdpr_consent with Data type Yes/No.

3. Add these functions to the VisitorPass integration role:

   Function (English UI)	Danish UI
   Person, Employee, Search	Person, Medarbejder, Søg
   Person, Employee, Announce	Person, Medarbejder, Opret
   Person, Employee, Issue identifier	Person, Medarbejder, Udsted ID-nøgle

4. Open Management → Maintain user role → VisitorPass integration → Configuration and set gdpr_consent to Edit value: Read/write.

Prepare the service

1. Copy the keystore for this host, webhook-keystore.p12, into conf\. Partisia issues it from its own certificate authority for the AEOS server's host name, and sends it with its password.

2. Look up the id of the gdpr_consent field — the <Id> of the definition named gdpr_consent:

   Partisia staff

   PRODUCTION.md in the visitorpass-aeos-integration repository › Credential Issued › Issue the keystore

   '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sch="http://www.nedap.com/aeosws/schema"><soapenv:Body><sch:FreeFieldDefinitionSearchInfo/></soapenv:Body></soapenv:Envelope>' | curl.exe -s -k -u '<soap-user>:<soap-password>' -H 'Content-Type: text/xml; charset=utf-8' -H 'SOAPAction: ' --data-binary '@-' https://localhost:8443/aeosws
   

Configure the service

Add tls, and replace monitor, visitorPass and webhook in server.json from the installation. Add gdprConsentDefinitionId to the aeos section:

server.json

  "tls": { // (1)!
    "keyStore": "conf/webhook-keystore.p12",
    "keyStorePassword": "<keystore-password>"
  },
  "monitor": { // (2)!
    "enabled": true,
    "delayMillis": 30000, // (3)!
    "requiredTemplateIds": [<authorisation-template-id>] // (4)!
  },
  "aeos": {
    ...
    "gdprConsentDefinitionId": <gdpr-consent-id> // (5)!
  },
  "visitorPass": { // (6)!
    "baseUrl": "https://visitorpass.partisia.com",
    "apiKey": "vp_<organisation-api-key>",
    "hostEmail": "<host-employee-email>",
    "purpose": "Worker GDPR consent",
    "templateId": "<visit-template-id>",
    "visitDurationHours": 8760
  },
  "webhook": { // (7)!
    "secret": "<webhook-secret>"
  },

1. Lets VisitorPass call the service over HTTPS on port.

   Value: the keystore from step 1, and the password Partisia sent with it.

2. Detection of new people in AEOS. enabled: true turns it on.

   On first start the service invites only people created or changed from then on. People already in AEOS are not invited.

3. The pause between two checks of AEOS, in milliseconds. 30000 is 30 seconds.

4. The AEOS authorisation templates whose holders are invited, for example white collar.

   Value: the template ids, from step 8 of the installation. An empty list invites everyone created in AEOS.

5. The id of the gdpr_consent free field, from step 2.

6. Where VisitorPass is, as on the installation page, plus the invitation each new person receives.

   apiKey: an API key for your organisation in VisitorPass. An administrator creates it in the VisitorPass dashboard under Settings → API keys. It is shown only once, when it is created.

   hostEmail: the employee named as host on the invitation. It must exist in VisitorPass.

   purpose: the purpose of the visit, shown on the invitation.

   templateId: the VisitorPass visit template the invitation uses. An administrator finds it in the dashboard under Templates: open the template, and the id is the last part of its address.

   visitDurationHours: how long the invitation stays valid. 8760 is a year.

7. The secret VisitorPass signs its calls into the service with.

   Value: Partisia subscribes this server to credential-issued events in VisitorPass, with a new secret, and sends you the secret.

Partisia staff

PRODUCTION.md in the visitorpass-aeos-integration repository › Credential Issued › Subscribe to credential-issued events for webhook.secret

Restart the service:

.\servy\servy-cli.exe restart --name visitorpass-aeos-integration

Verify

1. Check that the service now serves HTTPS:

   Select-String -Path logs\out.log -Pattern 'Listening on' | Select-Object -Last 1
   

2. Create a test person in AEOS who holds one of requiredTemplateIds, with an email address. Within a minute the service invites them:

   Select-String -Path logs\out.log -Pattern 'Initiated issuance' | Select-Object -Last 5
   

3. Accept the invitation from the test person's phone, and check that consent was recorded:

   Select-String -Path logs\out.log -Pattern 'Recorded GDPR consent','Assigned badge' | Select-Object -Last 5
   

4. Check in the AEOS web client that gdpr_consent is set on the test person.