USM-Biometric Administration Portal-ENG
USM-Biometric Administration Portal-ENG
USM-Biometric Administration Portal-ENG
Spica International
Pot k sejmiscu 33
1231 Ljubljana
Slovenia
E-mail: info@spica.com
www.spica.com
Contents I
Table of Contents
3 Main views 43
3.1 Users................................................................................................................................... 44
3.1.1 User details .......................................................................................................................................................... 45
3.2 Templates
................................................................................................................................... 46
3.2.1 Supported tem..........................................................................................................................................................
plate types 47
3.2.2 Tem plate com..........................................................................................................................................................
patibility overview 49
3.3 Devices
................................................................................................................................... 51
3.3.1 Device details.......................................................................................................................................................... 52
4 Administrator's tasks 53
4.1 Managing
...................................................................................................................................
devices 53
4.1.1 Add a new device
..........................................................................................................................................................
m anually 53
4.1.2 Add a new device
..........................................................................................................................................................
w ith auto discovery 55
4.1.3 Edit device .......................................................................................................................................................... 56
4.2 Managing
...................................................................................................................................
templates 57
4.2.1 Tem plate enrollm
..........................................................................................................................................................
ent 57
4.2.1.1 Template enrollment
.........................................................................................................................................................
on Spica Zone Touch 57
4.2.1.2 Template enrollment
.........................................................................................................................................................
on Morpho Sigma/Sigma Lite 59
4.2.1.3 Template enrollment
.........................................................................................................................................................
on L1 4G/4G Lite 61
1.1 Introduction
Biometric Administration Portal (BAP) is a web client responsible for the management of
fingerprints. The client offers enrolment and distribution of templates to L1 4G/4G Lite,
Morpho Sigma or Spica Zone Touch devices, which have IP connectivity.
Important note: The use of biometric information is regulated in many countries. Before
implementing, please make sure you are familiar with biometric information regulations in
your country.
This program and accompanying documentation (the software) are copyrighted material,
protected by national legislation and international agreements on protection of intellectual
property. Any unauthorized use or copying of this software is punishable by law. Users are
permitted to make copies of the software solely for backup purposes, and as a protection
against accidental loss or damage of the purchased copy.
By purchasing a copy of the software the user is granted the license to use the software
within the user's organization without time limitations. The user is obliged to comply to the
conditions related to the scope of the license as defined in the purchase documentation
(proposal/order/invoice) at the time of purchase. These conditions are including, but are not
limited to maximum number of users, number of clients, servers, number of administrators,
administrative workstations, computers, locations and similar. Any use beyond these
restrictions is not permitted.
Any use outside user's organization or any commercial exploitation of the software involving
third parties such as lending, renting or selling of the software is not permitted.
Special Terms
Users are obliged to actively protect the software against any unauthorized use or copying,
and prevent access to the software by the public or any third party. SPICA International does
not permit any modification of programs or accompanying documentation including any
modification of the program code or accompanying files.
Warranty Disclaimer
SPICA International has written the software and accompanying documentation with utmost
care and best effort to make it error free. Any eventual error, which would prevent or
significantly hamper the use of the software, should be immediately reported to SPICA
International. SPICA International will act upon such error report with priority and make every
effort to correct the error in the shortest possible time. However, the software is provided by
SPICA International »as-is«, and without any warranty, express or implied, direct or
consequential as to the usability or inability to use the software.
SPICA International does not provide any warranty as to the fitness of this software to any
particular purpose, and is not liable for any errors, known or unknown, of this software.
Cumulative liabilities of
SPICA International for any damage caused by this software will be limited to the purchase
price of this software.
Data
SPICA International is not in any way responsible for data maintained with this software. The
user is entirely and solely responsible for data safekeeping, protection against loss and
protection of privacy of personal information.
Modifications of Software
SPICA International continually develops and improves its software products, which are
therefore subject to change without prior notice. SPICA International reserves the right to
freely modify its software products at any time without any prior or special notice and cannot
provide any warranty as to the nature and scope of any particular change. SPICA
International also retains the right to stop further development of a particular product, or to
discontinue a product completely.
In order to meet and surpass the expectations of its users, SPICA International constantly
and systematically collects information about user demands and requirements. This
information plays crucial role in decisions on software product development. Upon user
request, SPICA International will provide information on the status of an individual request or
demand in the context of development planning for the standard products. This information
may include the planned time for the completion of a particular task, if any such time has
been established. Information provided in this way does not make SPICA International in any
way liable for the nature and scope of the actual implementation, licensing policy or time of
delivery. All such information is strictly informal and may change without any notice.
Spica International
Pot k sejmiscu 33
1231 Ljubljana
Slovenia
Basic architecture
4G devices
Use an external power supply that provides a minimum of 1A at 12VDC PER DEVICE. The
power supply should be regulated, filtered, and dedicated to L-1 EAS products only. If sharing
power between devices, be sure that each device receives 1A (e.g. two devices would
require a 12VDC, 2A supply). For more information, see 4G Quick Start Guide.
When the device is powered over Ethernet, an IEEE 802.3af compliant Active Midspan
Injector must be used. This injector is not supplied with Bioscrypt products.
4G Lite devices
Use an external power supply that provides a minimum of 1A at 12VDC PER DEVICE. The
power supply should be regulated, filtered, and dedicated to L-1 EAS products only. If sharing
power between devices, be sure that each device receives 1A (e.g. two devices would
require a 12VDC, 2A supply). For more information, see 4G Lite Quick Start Guide.
When the device is powered over Ethernet, an IEEE 802.3af compliant Active Midspan
Injector must be used. This injector is not supplied with L-1 EAS products.
Important: Under powering may cause memory and data corruption; over powering may
cause hardware damage. Both of these situations will void the warranty.
When connected over Wiegand protocol, 4G device acts like an external reader in the
Time&Space system. The protocol itself is communicating in one direction and needs only two
wires for transferring ID number with a parity check.
Table 1 shows wiring relations for connecting 4G device as an external reader on channel 1
(Reader 1) on the DOX controller. To connect to a different channel, adjust the block
parameters according to the DOX schema.
Table 1
In case when a 4G device does not have an internal reader you can connect an external
reader. Table 2 shows wiring relations for connecting an external HID reader to the 4G
device. For other readers please see respective installation manual.
Table 2
In previous situation when you have an external reader connected to the 4G device (Table 2)
in combination with a DOX controller, you can also connect reader signalization LEDs (Table
3). Now the user can see directly the on reader if the verification of the badge with fingerprint
was successful on the DOX level.
Table 3
Table 4 shows wiring relations for connecting 4G device as an external reader on the Z1B-TT.
Make sure that Ground and Wiegand GND connectors are also connected!
Table 4
Extended ID mode
In case when card numbers are 33-bits or greater, reader needs to be set to Extended ID
mode for enrolment and operation, because additional parity bits and facility/site codes are
included. This is done by settings Input Wiegand Format to appropriate format.
Go to Device Settings\Wiegand tab on the desired device, choose Predefined check box
under Set Wiegand Format To and select a proper Wiegand format in the drop-down list.
You can use predefined Generic 64 format or create and select a custom one.
Important: If template is enrolled on a device which does not have extended id enabled,
then this template can only be uploaded to such devices. Upload to device with enabled
extended id is not possible.
2.1.3.1.1 Identification
1. Go to Device Settings\Biometric tab on the desired device, check Identify in the Device
Mode section and select appropriate template type. Make sure that the Activate Auto Finger
Detection option is checked.
Identification m ode
2. Switch to Wiegand tab, select Custom Wiegand Settings and create a new custom format
which will support card numbers up to 32-bit (4294967295). Once the Wiegand format has
been created, it has to be uploaded to the reader. Click on Upload, select the previously
uploaded format from the drop down menu and click on Apply, Apply again and Close.
Important: If card numbers in the system are greater than 32-bit than the reader must
be set to Extended ID mode.
3. To activate custom Wiegand format, select Wiegand Output Settings and select a proper
Wiegand format in the drop-down list under Identification Pass and Fail.
2.1.3.1.2 Verification
1. Go to Device Settings\Biometric tab on the desired device, check Verify in the Device
Mode section and select appropriate template type.
Verification m ode
2. Switch to Wiegand tab, select Custom Wiegand Settings and create a new custom format
which will support card numbers up to 32-bit (4294967295). Once the Wiegand format has
been created it has to be uploaded to the reader. Click on Upload, select the previously
uploaded format from the drop down menu and click on Apply, Apply again and Close.
3. To activate custom Wiegand format, select Wiegand Output Settings and select a proper
Wiegand format in the drop-down list under Identification Pass and Fail.
4. Set the reader to the Extended ID mode, which is needed for verification mode on 4G
devices.
Go to Network\Access Control tab on the desired device, check Use Template Setting of
each user in the Access Rule section.
Extended ID mode
In case when card numbers are 33-bits or greater, reader needs to be set to Extended ID
mode for enrolment and operation, because additional parity bits and facility/site codes are
included. This is done by settings Input Wiegand Format to appropriate format.
Go to Network\Wiegand tab on the desired device, choose Predefined check box under Set
Wiegand Format To and select a proper Wiegand format in the drop-down list. You can use
predefined Generic 64 format or create and select a custom one.
Important: If template is enrolled on a device which does not have extended id enabled,
then this template can only be uploaded to such devices. Upload to device with enabled
extended id is not possible.
2.1.3.2.1 Identification
1. Go to Network\Biometric tab on the desired device, check Identify in the Device Mode
section and select appropriate template type.
Identification m ode
2. Switch to Wiegand tab, select Custom Wiegand Settings and create a new custom format
which will support card numbers up to 32-bit (4294967295). Once the Wiegand format has
been created it has to be uploaded to the reader. Click on Upload, select the previously
uploaded format from the drop down menu and click on Apply, Apply again and Close.
Important: If card numbers in the system are greater than 32-bit than the reader must
be set to Extended ID mode.
3. To activate custom Wiegand format, select Wiegand Output Settings and select a proper
Wiegand format in the drop-down list under Identification Pass and Fail.
2.1.3.2.2 Verification
1. Go to Network\Biometric tab on the desired device, check Verify in the Device Mode
section and select appropriate template type.
Verification m ode
2. Switch to Wiegand tab, select Custom Wiegand Settings and create a new custom format
which will support card numbers up to 32-bit (4294967295). Once the Wiegand format has
been created it has to be uploaded to the reader. Click on Upload, select the previously
uploaded format from the drop down menu and click on Apply, Apply again and Close.
Important: If card numbers in the system are greater than 32-bit than the reader must
be set to Extended ID mode.
To activate custom Wiegand format, select Wiegand Output Settings and select a proper
Wiegand format in the drop-down list under Identification Pass and Fail.
3. Choose Custom check box under Set Wiegand Format To and select the 32-Bit format in
the drop-down list.
Installation requirements
IIS feature
ASP features
If having x64 bit OS set Enable 32-Bit Applications option to True for the used application
pool (e.g. DAP).
To enable Active Directory authentication and Single Sing On (SSO) in the application, enable
Windows Authentication on the virtual directory and set NTLM provider to the first place.
Window s Authentication
Providers
Tip: Windows features list may variate according to a specific operating system.
Welcom e screen
3. By default, the application will be installed as a virtual directory called BAP on Default Web
Site. Change the name of virtual directory or site if necessary. In this case, users will access
the application by entering address http://HostName/BAP into the web browser. Host Name
signifies the name or the IP address of the computer where IIS is running.
Database type
5. Confirm the installation parameters with Next button and start the installation process.
7. After the installation is completed, see Customizable application parameters chapter for
additional settings.
Server kind - <add key="ServerKind" value="mssql" /> - This parameter defines the
kind of database server which is used in the system.
Session time out - <forms loginUrl="~/Account/LogOn" timeout="30" /> - This
parameter defines the period after which the session expires in the application. By default
this parameter is set to 30 minutes.
Language - <globalization Culture="en-GB" culture="en-GB"/> - This parameter
defines the language of the web application. Currently the following languages are
supported: Arabic (ar), Bosnian (sr-Cyrl-BA), Bulgarian (bg), Croatian (hr), English (en-GB),
Finnish (fi), French (fr), German (de), Greek (el), Italian (it), Lithuanian (lt), Macedonian (mk),
Polish (pl), Portuguese (pt), Romanian (ro), Russian (ru), Slovenian (sl), Turkish (tr) and
Ukrainian (uk).
NLog.config
To remove the existing module, got to Control Panel\Programs and Features and select the
Time&Space Biometric Administration Portal software and choose Uninstall.
Re-installation
To install a new version of the module, simply start and follow the installation procedure.
2.3 Login
To access BAP, enter this address http://HostName into the web browser (Host Name
signifies the name or the IP address of the computer where BAP is installed). User account
needs Biometric Administration Portal Login permission to enter the application.
Login dialogue
3 Main views
The application has three main views:
3.1 Users
Users view shows the list of all users in the system according to user's permissions. To find a
particular user, use the filter section or search field. When the user is located, click on the
user's name to view user details.
- Starts the procedure for deleting templates in database and/or from devices.
- Opens a new dialogue for enrolling a new template.
Users view
Note: Restrictions by Unit 1/Unit 2/Unit 3 or Organisational units are applied on this view.
This means that a user will see only users, he/she is entitled to see.
User details
Warning: If you want to set a multiple authentication modes (e.g. fingerprint and card/
keypad) for one user on the same Sigma device, you need add an additional badge badge
and link each authentication with a different badge.
Warning: Authentication modes which can be set when uploading the template do not
apply to Spica Zone Touch device. The verification modes are set on the related reader
configuration in Device Administration Portal.
3.2 Templates
Templates view shows the list of all fingerprints in the Time&Space database. Use the filter
section or search field to find appropriate data.
- Starts the procedure for deleting templates in database and/or from devices.
- Opens a new dialogue for updating the parameters of individual template in the
database.
- Checks the suitability of individual template in the database.
- Uploads an individual template to a specific device.
- Opens a new dialogue for transferring a template to another badge.
- Deletes an individual template from the database.
Warning: Currently only PK Lite template type is supported on Morpho Simga in the
application.
There are five types of templates supported by L-1 Identity Solutions products:
A 348-byte template (*.tem) contains a unique ID, which is usually associated with a single
individual. If multiple enrolments for additional fingers of the same person are required, the
same ID is used but a unique index value (0-255) is assigned to each enrolment under that
ID. It is important to note that multiple indexes for the same ID are still considered individual
and separate templates.
A 1:200 searching template (*.mtm) contains the entire 1:1 template, which is 348 bytes,
with the addition of 2004 bytes of data needed for searching functionality, making the total
length of 1:200 searching template 2352 bytes. When the device mode is configured for
1:200 MTM, the device will have a maximum capacity of 200 templates.
1:500 searching template (*.tms) contains the entire 1:1 template, which is 348 bytes, with
the addition of 2140 bytes of data needed for searching functionality, making the total length
of this searching template 2488 bytes. When the device mode is configured for 1:500 TMS,
the device will have a maximum capacity of 500 templates.
USER RECORDS
Global data - This is information relevant to the entire record, such as user ID, name,
password, etc. Some fields are “required”while others are “optional.”The User ID field, for
example, is required.
Enrolment data - This is data pertaining only to a particular finger. It is a section of data
that contains compressed fingerprint information along with specific information relating to
that enrolment, such as which sensor was used, which finger was enrolled, the security
level for the finger, and the index. A User Record can contain more than one enrolled finger
when stored on the device.
User data - This is a user defined variable length block of data that can either be global or
enrolment specific. Data in this block is accessed all at once, rather than being divided into
separately named fields.
The Biometric User Record can be utilized on the 4G products for the following authentication
purposes:
Legend
Status
- Supported.
1 – Supported if device is set to Extended ID mode.
- Not supported.
Badge length
Up to 9 digit = (1 - 999999999)
9 digit + < 32 bit = (1000000000 – 4294967295
32 bit + = (4294967295 - …)
Template type
Device
Software
3.3 Devices
Devices view shows the list of all configured devices in the system with some basic
parameters:
Tip: If you click the device's name, a new dialogue will appear showing device details.
- Scans the local network for connected devices and lists the results.
- Updates the parameters of selected device in database.
- Removes the selected device from the system.
Devices view
Device details
Note: Device users license cannot be directly related with the number of users in the
system, because the templates are connected with badges and not users. Thus if a user has
multiple badges (e.g. 3 badges) and all have permission for the same device, then this user
will need 3 user's licenses on this device.
4 Administrator's tasks
Devices view
A new dialogue, called Add device is opened. Enter the desired name and valid IP address of
the device and finish the procedure by selecting Add button. If you do not know the IP
address of you device, use Secure Admin to check the configuration parameters.
If the device is accessible (icon ), device details information is shown and stored into
database.
If the device is currently not accessible (icon ) detailed information is not shown, but the
device is still added to the system. When the device becomes available, you can update
device information with Update action from the Devices view.
Devices view
When action is completed, the results are displayed as a list of available devices. To add an
individual device select Add action or use Add All action to add all devices at once.
Important: Device discovery action is working according to the method called multicast
IP. If a router or gateway, which is installed on the local network, is configured to pass
packets between two subnets, then devices will be visible. Otherwise it might happen that
search results will not display all installed devices. In this case you can use the procedure for
manual adding of devices.
Edit device
On the first step of enrolment process you need to select the following parameters:
Badge - Select the badge under which the template will be stored. The template is directly
connected to a specific badge, not a user.
Device - Select the device on which the enrolment will be performed.
Template index - Select template index (from 0 to 1). A user can have up to 2 templates.
Finger index - Select which finger will be used for enrolment. This information is useful for
verification or update actions.
Select Enroll and place your finger on the sensor. If enrolment is successful, template results
will be displayed and template is automatically saved to the database. To upload the enrolled
template to the specific device, choose a device from the combo and select Upload action. To
enroll additional finger, select Enroll another finger action.
Note: Storing template on card (TOC) is not supported in this version of application.
Warning: Authentication modes which can be set when uploading the templates do not
apply to Spica Zone Touch device. The verification modes are set on the related reader
configuration in Zone Administration Portal.
On the first step of enrolment process you need to select the following parameters:
Badge - Select the badge under which the template will be stored. The template is directly
connected to a specific badge, not a user.
Device - Select the device on which the enrolment will be performed.
Template index - Select template index (from 0 to 1). A user can have up to 2 templates.
Finger index - Select which finger will be used for enrolment. This information is useful for
verification or update actions.
Select Enroll and place your finger on the sensor. If enrolment is successful, template results
will be displayed and template is automatically saved to the database. To upload the enrolled
template to the specific device, choose a device from the combo and select Upload action. To
enroll additional finger, select Enroll another finger action.
Note: Storing template on card (TOC) is not supported in this version of application.
On the first step of enrolment process you need to select the following parameters:
Badge - Select the badge under which the template will be stored. The template is directly
connected to a specific badge, not a user.
Device - Select the device on which the enrolment will be performed.
Template index - Select template index (from 0 to 3). A user can have up to 4 templates
per template type.
Finger index - Select which finger will be used for enrolment. This information is useful for
verification or update actions.
Security level - Select appropriate security level (0 - No security, any finger will pass; 1 -
Very high security; 2 - High security; 4 - Low security; 5 - Very low security; 6 - Password
only (fingerprint not required). In case of verification device mode, lower security is used
between the global verification security level and the template security level.
Card Serial Number - This information is obligatory if having 4G Lite devices in verification
mode. For other modes/devices this step can be skipped.
Card Type - Card type is automatically selected when card serial number is read from card.
Important: Maximum badge number which can be used for template storage is
4294967295 if device is not in Extended ID mode.
Select Enroll and place your finger on the sensor. If enrolment is successful, template results
will be displayed and template is automatically saved to the database. To upload the enrolled
template to the specific device, choose a device from the combo and select Upload action. To
enroll additional finger, select Enroll another finger action.
Note: Storing template on card (TOC) is not supported in this version of application.
Users view
On the Verify dialogue, select the device where the verification will be performed. Finger
index value signalizes information to which finger template is related (0 - Left little finger, .... ,
9 - Right little finger).
Verify dialogue
If the verification is successful, user will be informed with a message "Template verification
successful".
Successful verification
In case of unsuccessful verification, user is informed with a current and required score.
Unsuccessful verification
On the Verify dialogue, select the device where the verification will be performed. Finger
index value signalizes information to which finger template is related (0 - Left little finger, .... ,
9 - Right little finger).
Verify dialogue
Warning: Make sure that the device template mode matches the template type.
If the verification is successful, user will be informed with a message "Template verification
successful".
Successful verification
In case of unsuccessful verification, user is informed with a current and required score.
Unsuccessful verification
On the Verify dialogue, select the device where the verification will be performed. Finger
index value signalizes information to which finger template is related (0 - Left little finger, .... ,
9 - Right little finger).
Verify dialogue
Warning: Make sure that the device template mode matches the template type.
If the verification is successful, user will be informed with a message containing validation
score. The score indicates the similarity of the candidate and template from the database.
Successful verification
In case of unsuccessful verification, user is informed with a current and required score.
Unsuccessful verification
Users view
On the Copy dialogue, select destination badge to which template will be transferred and
start the procedure with Copy action.
Copy action
Warning: If you want to set a multiple authentication modes (e.g. fingerprint and card/
keypad) for one user on the same Sigma device, you need add an additional badge badge
and link each authentication with a different badge.
Warning: Authentication modes which can be set when uploading the templates do not
apply to Spica Zone Touch device. The verification modes are set on the related reader
configuration in Device Administration Portal.
Note: If option Overwrite template only if its quality is better is selected, only
templates with a better quality than existing ones will be save to database.
Note: This action is currently not supported on Spica Zone Touch device.
Important: If option Also delete fingerprints from database is selected, fingerprints for
the selected users will be also deleted from database.