Novell IDENTITY ASSURANCE SOLUTION 3.0.2 -... User manual

Novell
www.novell.com
novdocx (en) 11 December 2007
Identity Assurance Solution 3.0.2 Administration Guide
Identity Assurance Solution
3.0.2
February 15, 2008
ADMINISTRATION GUIDE

novdocx (en) 11 December 2007
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the
Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on
exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2008 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 11 December 2007
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

novdocx (en) 11 December 2007

Contents 5
Contents
novdocx (en) 11 December 2007
About This Guide 7
1Overview 9
1.1 System-Wide Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Agency-Specific Roles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.3 What’s Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2 Managing System-Wide Roles 13
2.1 System Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.1.1 Add a User to a System-Wide Role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.1.2 Remove a User from a System-Wide Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.2 System Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3 Activator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.1 No Applicant Match for Shipped Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.3.2 Wrong Cards Shipped to Valid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.4 Registrar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3 Managing Agency-Specific Roles 15
3.1 Agency Sponsor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.1.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.1.2 Create a New User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1.3 Delete a User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1.4 Display Applicant Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.1.5 Request Card Reissuance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.1.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.1.7 Sponsor New Applicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.1.8 Update Applicant Employment Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2 Agency Adjudicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.2.1 Change To Adjudication Record (Manual) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.3 Agency Security Officer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.3.1 Card Destruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.3.2 Change PIV Card Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3.3 Invalid Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3.4 Invalid Source Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.3.5 Impersonation Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.3.6 Request Card Reprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.4 Agency Role Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.4.1 Add a User to an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.4.2 Remove a User from an Agency-Specific Role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4 Troubleshooting 25
4.1 Known Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.1.1 Do Not Use Enter Key When Requesting Applicant Card. . . . . . . . . . . . . . . . . . . . . 25
4.1.2 Required Browser for IAS Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.1.3 COULD_NOT_FIND_USER Error While Retrieving User
AIMS_NO_SUCH_WALLET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

6Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
A IAS Administration Security 27
A.1 Signed Workflows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
A.2 Novell Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
A.3 Third-Party Products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
B Documentation Updates 29
B.1 February 8, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
B.1.1 Upgraded IAS from 3.0.1 to 3.0.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
B.1.2 Documentation Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
C Documentation Updates 31
C.1 February 15, 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
C.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

About This Guide
novdocx (en) 11 December 2007
7
About This Guide
This guide provides information on performing basic administration tasks for the Identity Assurance
Solution.
Chapter 1, “Overview,” on page 9
Chapter 2, “Managing System-Wide Roles,” on page 13
Chapter 3, “Managing Agency-Specific Roles,” on page 15
Chapter 4, “Troubleshooting,” on page 25
Appendix A, “IAS Administration Security,” on page 27
Audience
This guide is intended for system administrators and system integrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Identity Assurance Solution Administration Guide, visit the
Identity Assurance Solution Documentation Web site (http://www.novell.com/documentation/
ias301/index.html).
Documentation Conventions
In Novell®documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007

Overview
1
novdocx (en) 11 December 2007
9
1
Overview
Novell®has partnered with third-party companies to build a solution that offers an integrated logical
and physical control system that complies with Homeland Security Presidential Directive 12
(HSPD-12). HSPD-12 directs the implementation of a new standardized badging process, which is
designed to enhance security, reduce identity fraud, and protect the personal privacy of users who
are issued government identification.
Identity Assurance Solution provides a complete system for managing the enrollment, issuance,
access control, and retirement of Personal Identification Verification (PIV) cards. This solution is in
compliance with the Federal Information Processing Standards Publication 201 (FIPS 201) and
provides components such as an Identity Management System (IDMS), a User Enrollment/
Biometric Capture system, a Card Management System (CMS), and Logical and Physical Access
Control Systems (LACS/PACS).
During the installation of the Identity Assurance Solution, several roles are created. These roles and
their associated tasks are based on the General Services Administration (GSA) standards. Those
users who are assigned to these roles can perform their tasks by using the User Application for
Provisioning through a Web browser.
This document outlines the roles and tasks performed by each role for the Identity Assurance
Solution.
1.1 System-Wide Roles
This solution includes the following system-wide roles:
Table 1-1 System-Wide Roles
System-Wide Role Description Tasks
System Role Administrator
For more information, see
Section 2.1, “System Role
Administrator,” on page 13.
Responsible for adding and removing
other users from roles in the system.
Can add or remove users from all
system-wide roles and from the
agency role administrator’s role for
each agency. Cannot add or remove
users from agency-specific roles.
Add a User to a System-
Wide Role
Remove a User from a
System-Wide Role
System Security Officer
For more information, see
Section 2.2, “System Security
Officer,” on page 14.
Responsible for viewing and
managing the audit log. Does not
have any specific workflow tasks but
is responsible to enforce the rules
and policies related to PIV card
requests, activations, and issuances.
No workflow tasks

10 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
1.2 Agency-Specific Roles
This solution includes the following agency-specific roles:
Table 1-2 Agency-Specific Roles
Activator
For more information, see
Section 2.3, “Activator,” on
page 14.
Runs the CMS system. Responsible
for activating an applicant's PIV card
after it comes back from the card
production facility. Verifies the
applicant’s identity by using a
biometric scan and oversees the
personalization of the card by
generating keys, loading certificates
onto the card, and initializing the
card’s PIN number. Sends all this
information to the Identity Vault and
notifies the system that the card has
been issued.
No Applicant Match for
Shipped Cards
Section 2.3.2, “Wrong Cards
Shipped to Valid Address,”
on page 14
Registrar
For more information, see
Section 2.4, “Registrar,” on
page 14.
Runs the biometric enrollment
system. The registrar does the
identity-proofing and captures the
applicant’s identification information
and biometric data. This information
is forwarded to the Idenitity Vault.
No workflow tasks
Agency-Specific Role Description Tasks
Agency Sponsor
For more information, see
Section 3.1, “Agency
Sponsor,” on page 15.
Responsible for initiating a PIV card
request on behalf of an applicant and
is the only user that can initiate a PIV
card request. Updates an applicant's
employment status (terminated,
active, or suspended) and modifies
information about the applicant in the
system (change the applicant's
name, job title, etc.).
Card Destruction
Create a New User
Delete a User
Display Applicant
Information
Request Card Reissuance
Request Card Reprint
Sponsor New Applicant
Update Applicant
Employment Status
Agency Adjudicator
For more information, see
Section 3.2, “Agency
Adjudicator,” on page 20.
Responsible for performing
background checks on applicants. At
the end of the biometric enrollment
process, initiates an Automated
Fingerprint Identification System
(AFIS) check and the manually
performs a National Agency Check
with Inquiries (NACI) check or FBI
check. Based on the results of these
checks, determines if the card
request can proceed.
Change To Adjudication
Record (Manual)
System-Wide Role Description Tasks

Overview 11
novdocx (en) 11 December 2007
1.3 What’s Next
To view information on performing tasks assigned to system-wide roles, see Chapter 2, “Managing
System-Wide Roles,” on page 13.
To view information on performing tasks assigned to agency-specific roles, see Chapter 3,
“Managing Agency-Specific Roles,” on page 15
Agency Security Officer
For more information, see
Section 3.3, “Agency Security
Officer,” on page 20.
Responsible to ensure that the
agency is following all policies
regarding the use of PIV cards. If a
PIV card is terminated, the agency
security officer collects the card from
the user.
Card Destruction
Change PIV Card Status
Invalid Address
Invalid Source Documents
Impersonation Check
Request Card Reprint
Agency Role Administrator
For more information, see
Section 3.4, “Agency Role
Administrator,” on page 23.
Responsible for adding and removing
other users from agency-specific
roles.
Add a User to an Agency-
Specific Role
Remove a User from an
Agency-Specific Role
Agency-Specific Role Description Tasks

12 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007

Managing System-Wide Roles
2
novdocx (en) 11 December 2007
13
2
Managing System-Wide Roles
This section outlines the system-wide roles and tasks performed by each role for the Identity
Assurance Solution.
When you are working with the workflow forms, all fields with an asterisk (*) are required fields.
Section 2.1, “System Role Administrator,” on page 13
Section 2.2, “System Security Officer,” on page 14
Section 2.3, “Activator,” on page 14
Section 2.4, “Registrar,” on page 14
2.1 System Role Administrator
A system role administrator can perform the following tasks:
Section 2.1.1, “Add a User to a System-Wide Role,” on page 13
Section 2.1.2, “Remove a User from a System-Wide Role,” on page 13
2.1.1 Add a User to a System-Wide Role
This task allows the system role administrator to add a user to a system-wide role.
1Log in to IAS Workflow as a system role administrator.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Add a User to a System-Wide Role.
5Select the system-wide role you want to assign a user to.
6In the Search by field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
7Select the user.
8Click Submit.
2.1.2 Remove a User from a System-Wide Role
This task allows the system role administrator to remove a user from a system-wide role.
1Log in to IAS Workflow as a system role administrator.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Remove a User from a System-Wide Role.
5In the Search by field, select a value from the drop-down menu.

14 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Select the user.
7Click Remove.
2.2 System Security Officer
The system security officer is responsible for administering the audit system and does not have any
specific workflow tasks.
2.3 Activator
An activator can perform the following tasks:
Section 2.3.1, “No Applicant Match for Shipped Cards,” on page 14
Section 2.3.2, “Wrong Cards Shipped to Valid Address,” on page 14
2.3.1 No Applicant Match for Shipped Cards
If an applicant doesn’t claim his or her PIV card, the activator can create an audit log for the event.
1Log in to IAS Workflow as an activator.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click No Applicant Match for Shipped Cards.
5Type a note explaining that the applicant has not claimed his or her card.
6Select the Warning and Usage Statement, then click Sign Approval.
7Click Submit.
2.3.2 Wrong Cards Shipped to Valid Address
If the wrong cards are shipped to a valid address, the activator can create and audit log for the event.
1Log in to IAS Workflow as an activator.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Wrong Cards Shipped to Valid Address.
5Type a note explaining that the wrong cards were shipped.
6Select the Warning and Usage Statement, then click Sign Approval.
7Click Submit.
2.4 Registrar
The registrar interacts directly with the biometric enrollment system and does not have any specific
workflow tasks.

Managing Agency-Specific Roles
3
novdocx (en) 11 December 2007
15
3
Managing Agency-Specific Roles
This section outlines the agency roles and tasks performed by each role for the Identity Assurance
Solution.
When you are working with the workflow forms, all fields with an asterisk (*) are required fields.
Section 3.1, “Agency Sponsor,” on page 15
Section 3.2, “Agency Adjudicator,” on page 20
Section 3.3, “Agency Security Officer,” on page 20
Section 3.4, “Agency Role Administrator,” on page 23
3.1 Agency Sponsor
The agency sponsor can perform the following tasks:
Section 3.1.1, “Card Destruction,” on page 15
Section 3.1.2, “Create a New User,” on page 16
Section 3.1.3, “Delete a User,” on page 16
Section 3.1.4, “Display Applicant Information,” on page 17
Section 3.1.5, “Request Card Reissuance,” on page 17
Section 3.1.6, “Request Card Reprint,” on page 18
Section 3.1.7, “Sponsor New Applicant,” on page 18
Section 3.1.8, “Update Applicant Employment Status,” on page 19
3.1.1 Card Destruction
This task allows the agency sponsor to create an audit trail when a card is destroyed.
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Card Destruction.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user and card information are automatically filled in.
8Select the Warning and Usage Statement, then click Sign Approval.
9Ensure that all required fields are filled in, then click Submit.

16 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
3.1.2 Create a New User
The Identity Assurance Solution has two ways to create users:
“Human Resources Adds the User to the Identity Vault at the Time the User Is Hired” on
page 16
“The Sponsor Uses IAS Workflow to Add a User to the Identity Vault” on page 16
Human Resources Adds the User to the Identity Vault at the Time the User Is Hired
In the first instance, Human Resources creates the User object in the Users container with the
following attributes populated:
fipsDateOfBirth (use YYYYMMDD format)
fipsFirstName
fipsFirstNameAndMiddleInitial
fipsMiddleName
fipsLastName
fipsFullName
fipsSSNumber (Use xxx-xx-xxxx format)
fipsSSNLastFour (last four digits of the SSN)
Human Resource then creates a Card object in the Agency container with the following attributes
populated:
fipsCardAgencyDN (points to the fipsAgency object in the Agency container)
fipsCardOwnerDN (points to the corresponding user object in the Users container)
fipsFASCNAgencyCode (four digit agency code for the agency in this container. This can be
read from the Agency object.)
After creating the Card object, set the following attribute on the User object you created:
fipsAgencyCardDNs (Adds a value that points to the card object you created)
The Sponsor Uses IAS Workflow to Add a User to the Identity Vault
In the second instance, the sponsor uses a workflow to add a user:
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Create a New User.
5Fill in the required fields, then click Submit.
3.1.3 Delete a User
When an agency sponsor deletes a user, the user is removed from the Identity Vault.
1Log in to IAS Workflow as an agency sponsor.

Managing Agency-Specific Roles 17
novdocx (en) 11 December 2007
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Delete a User.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user information is automatically filled in.
8Click Submit.
3.1.4 Display Applicant Information
This task allows the agency sponsor to view the applicant’s user and card information.
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Display Applicant Information.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user and card information are automatically filled in.
8Click OK.
3.1.5 Request Card Reissuance
This task allows the agency sponsor to force a re-enrollment and have a new PIV card reprinted, if
something happens to the original card.
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Request Card Reissuance.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user and card information are automatically filled in.

18 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
8Select a reason why the card is being reissued. The options are:
Biometrics no longer valid
Damaged
Lost
Stolen
9Select the Warning and Usage Statement, then click Sign Approval.
10 Ensure that all required fields are filled in, then click Submit.
3.1.6 Request Card Reprint
This task allows the agency sponsor to request a reprint of a PIV card without requiring a re-
enrollment. A sponsor might use this task if an applicant’s name has changed or if a bad card was
identified during the application process.
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Select Request Card Reprint.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user and card information are automatically filled in.
8Select the Warning and Usage Statement, then click Sign Approval.
9Ensure that all required fields are filled in, then click Reprint.
3.1.7 Sponsor New Applicant
This workflow allows an agency sponsor to request a PIV card for the following types of applicants:
New Applicant: When a new applicant is entered in the system for the first time, the agency
sponsor fills in any required data fields that don’t have a value.
Unaffiliated Applicant: An unaffiliated applicant is a person who has been sponsored before,
but whose sponsorship has been terminated or expired. This person is not currently sponsored
by an agency. When an agency wants to sponsor an unaffiliated applicant, it can use the Social
Security number or last name and date of birth to look up the applicant. All the applicant
information pre-populate in the sponsorship screen and links the applicant to the sponsor’s
agency.
To start the Sponsor New Applicant workflow:
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.

Managing Agency-Specific Roles 19
novdocx (en) 11 December 2007
4Click Sponsor New Applicant.
5For an existing applicant, select a value from the Search by drop-down menu, then click
Search.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
For a new applicant, fill in the information for each required field.
6Select the Warning and Usage Statement, then click Sign Approval.
7Ensure that all required fields are filled in, then click Submit.
3.1.8 Update Applicant Employment Status
An agency sponsor can update the employment status of an applicant to one of the following:
Active: This status indicates that the applicant is an active employee in the system. An Active
status is required to issue a card and credentials. By changing an applicant’s status to Active,
you can reactivate a suspended card. Also, if an agent on one of the connected systems
reactivates a card, the IAS system updates the card status to Reactivated, but the event is not
propagated to any other systems until the sponsor sets the user's employee status to Active.
Suspended: This status indicates that the employee is temporarily placed on inactive duty.
While the employee is in the suspended state, the PIV Card credentials are automatically
suspended as well.
Terminated: This status indicates that the employee is terminated and no longer requires the
PIV Card credentials. A terminated employment status automatically revokes the PIV Card
credentials.
The employment status only impacts the card to which the sponsorship is linked.
To start the Update Applicant Employment Status workflow:
1Log in to IAS Workflow as an agency sponsor.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Update Applicant Employment Status.
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user information is automatically filled in.
8In the Change Employee Status field, select a new status.
9Select the Warning and Usage Statement, then click Sign Approval.
10 Ensure that all required fields are filled in, then click Submit.

20 Identity Assurance Solution 3.0.2 Administration Guide
novdocx (en) 11 December 2007
3.2 Agency Adjudicator
The agency adjudicator performs background checks on the applicants and makes changes to the
adjudication record.
3.2.1 Change To Adjudication Record (Manual)
This task allows the agency adjudicator to enter the results of background checks by the FBI and
NACI. If the result is negative, the card and all active credentials are revoked.
This task describes how to use the workflow to manually change the adjudication record. Normally,
this task is an auto-started task.
1Log in to IAS Workflow as an agency adjudicator.
2Click Requests & Approvals > Request Resources.
3Click Continue.
4Click Change to Adjudication Record (Manual).
5In the Search type field, select a value from the drop-down menu.
You can search for the user by either typing the user’s last name and date of birth or by typing
the user’s Social Security number and date of birth.
6Click Search.
7Select the user.
The user, card, and adjudication record information are automatically filled in.
8Select a new NACI status.
9Select a new FBI status.
10 Specify a comment.
11 Ensure that all required fields are filled in, then click Submit.
3.3 Agency Security Officer
The agency security officer can perform the following tasks:
Section 3.3.1, “Card Destruction,” on page 20
Section 3.3.2, “Change PIV Card Status,” on page 21
Section 3.3.3, “Invalid Address,” on page 21
Section 3.3.4, “Invalid Source Documents,” on page 22
Section 3.3.5, “Impersonation Check,” on page 22
Section 3.3.6, “Request Card Reprint,” on page 23
3.3.1 Card Destruction
This task allows the agency security officer to create an audit trail when a card is destroyed.
1Log in to IAS Workflow as an agency security officer.
2Click Requests & Approvals > Request Resources.