3.6 Fingerprint settings

The following table describes the fingerprint modes that must be configured while using a specific fingerprint reader. Using the parameter fingerprint.mode, you can either configure a single or multiple fingerprint readers mode.

Mode Parameter

Description

fingerprint.mode: 1

To use the WBF API mode. In this mode, Advanced Authentication works with a processed fingerprint reader in Windows Biometric Framework API.

fingerprint.mode: 2

To use the Windows Biometric Framework (WBF) Direct mode. In this mode, Advanced Authentication works directly with a device driver.

NOTE:Some fingerprint readers that comply with the Windows Biometric Framework requires WBF Direct mode to function correctly. For example, NEXT Biometrics rmodels such as NB-3010-UL can operate in this mode when using the appropriate WBF driver. You can download the NEXT Biometrics driver from the link.

fingerprint.mode: 3

To use the Lumidigm mode. You must install the Lumidigm Driver. You can download the driver from the HID Global website. Some devices require that the Lumidigm Device Service is installed.

fingerprint.mode: 4

To use the DigitalPersona mode. You must install the DigitalPersona U.are.U RTE. You can download it from the DigitalPersona website.

NOTE:For compatibility between DigitalPersona RTE v3.x and old device like DigitalPersona U.are.U 4500 install the RTE 3.2 and later version without Digital Persona authentication service. During the setup, select Custom setup and then remove the authentication service feature.

fingerprint.mode: 5

To use the Green Bit DactyScan84c (multi-finger reader) reader. This mode is supported only on Linux RHEL kernel 3.x.x.

Prerequisites:

Before using the Green Bit DactyScan84c reader, you must install the eNBioScan-C1 Drivers. Ensure to save the following SO files to the /lib64 path of Linux workstation:

  • Nitgen eNBioScan-C1: libfp_device.so, libfp_device.so.1.0.0, libFPLib.so, libFPLib.so.6.0.1.9, libNBioBSPISO4JNI.so, libNBioBSPJNI.so, libNBioBSP.so, libNExportRawToISO.so, libvhm.so, libvhm.so.6.1.4.4.

  • Green Bit DactyScan84c: libAN2K_LIB.so, libBozorth.so, libDID20IP.so, libDID20.so, libDS40u.so, libDS84C.so, libDS84t.so, libDSBeep.so, libGBFINIMG.so, libGBFIR.so, libGBImgTran.so, libGBJPEG.so, libGBMSAPI.so, libGBNFIQ2.so, libGBNFIQ.so, libLfsConv.so, libLfs.so, libMC517.so, libMS527.so, libMS527t.so, libopencv_core.so, libopencv_imgproc.so, libopencv_ml.so, libqsqlite.so, libqtaudio_alsa.so, libqtmedia_pulse.so, libqxcb.so, libusb1.0.20gb.so, libVsRoll.so, libWSQPack.so.

NOTE:OpenText Advanced Authentication does not provide the libraries for the Green Bit DactyScan84c reader. Contact vendor support to obtain the middleware or driver libraries.

fingerprint.mode: 6

To use the eNBioScan-C1 reader. You must install the eNBioScan-C1 Drivers. This mode is supported only on Linux RHEL kernel 3.x.x.

NOTE:OpenText Advanced Authentication does not provide the libraries for the eNBioScan-C1 reader. Contact vendor support to obtain the middleware or driver libraries.

fingerprint.mode: 7

To use the Next Biometrics NB-3030-U-LT reader. This mode is supported only on Linux operating system. To get this device up and running, you need to complete some configurations. For further details, see Configuring the Next Biometric fingerprint device setting.

Prerequisite:

Before using the Next Biometrics NB-3030-U-LT reader, you must install the Next Biometrics NB-3030-U-LT drivers. Ensure to save the libNBBiometrics.so file to the /lib64 path of Linux workstation.

NOTE:OpenText Advanced Authentication does not provide the libraries for the Next Biometrics NB-3030-U-LT reader. Contact vendor support to obtain the middleware or driver libraries.

fingerprint.wsqBitrate

This Wavelet Scalar Quantization (WSQ) algorithm based parameter determines the amount of compression.

The 2.25 value yields around 5:1 compression and the 0.75 value yields around 15:1 compression. The default value is 2.25.

NOTE:As the service uses NBIS library, only Device Service for Windows supports the parameter.

3.6.1 Configuring multiple Fingerprint reader modes

Device Service supports multiple fingerprint reader modes. You can configure multiple modes in one of the following ways:

  • Specify numeric values assigned to each mode.

    For example: fingerprint.mode: 1,2,3 to use WBF API, WBF Direct, and Lumidigm modes.

  • Specify the mode names.

    For example: fingerprint.mode: WbfDirect,DigitalPersona to use WBF Direct and DigitalPersona modes.

  • Specify the combination of numeric value and mode name.

    For example: fingerprint.mode:1,WbfDirect,3 to use WBF API, WBF Direct, and Lumidigm modes.

NOTE:The fingerprint.mode: auto is the default mode which enables Lumidigm, DigitalPersona, and WbfDirect modes.

3.6.2 Configuring the Fingerprint settings

  1. Open the configuration file based on your platform:

    • Microsoft Windows: C:\ProgramData\NetIQ\Device Service\config.properties.

    • Linux: /opt/NetIQ/Device Service/config.properties.

    • Apple Mac OS X: Fingerprint readers are not supported.

  2. Specify the following parameters:

    • fingerprint.multifingerDevice to configure the type of fingerprint device in use.

      Set fingerprint.multifingerDevice: false (default value) to use single finger readers such as Lumidigm, DigitalPersona, and so on.

      Set fingerprint.multifingerDevice: true to use the Green Bit DactyScan84c multi-finger reader.

    • fingerprint.mode to configure fingerprint reader mode.

      Set fingerprint.mode: 3 to use the Lumidigm reader mode only.

      Set fingerprint.mode: 1,WbfDirect,3 to use more than one reader modes, WBF API, WBF Direct, and Lumidigm.

      For example, to enable three single finger readers: Lumidigm, DigitalPersona, and WbfDirect, the parameters must be configured as follows:

      fingerprint.mode: auto

      To use a multi-finger device, the parameters must be configured as follows:

      fingerprint.multifingerDevice: true

      fingerprint.mode: 5

  3. (Optional) Specify the following parameter to set the capture inactive time in seconds:

    fingerprint.captureTimeout: 15

    NOTE:The parameters are case-sensitive.

  4. (Optional) Specify the following parameter to enable the DigitalPersona readers to work with the other services along with Device Service:

    fingerprint.dp.cooperativeMode=true

    The default value is true. You can set the value to false to stop the DigitalPersona with the other services.

  5. Save the changes.

  6. Restart the Device Service.

NOTE:The parameter fingerprint.isoSupported: true (default value is true) enables Device Service to extract ISO from raw image that is received when a user scans fingerprints during authentication. This parameter helps to remove this additional step on the server and improves the authentication speed.

If you set the parameter as false, Device Service sends a raw image to the Advanced Authentication server and the server extracts ISO to match the fingerprints with a stored authenticator. This may cause performance issues in environments where hundreds of users perform fingerprint authentication at the same time.

3.6.3 Configuring the Next Biometric fingerprint device setting

Before using the Next Biometrics reader, you must perform the following:

  1. Ensure to save the libNBBiometrics.so files to the /lib64 path of Linux workstation.

  2. Create the 60-nextbiometrics-usb-devices.rules file to define the udev rules for Next Biometrics fingerprint reader using the below command:

    sudo vi 60-nextbiometrics-usb-devices.rules

  3. Copy the following attributes to the file and save the file:

    SUBSYSTEM=="usb", ATTR{idVendor}=="298d", ATTR{idProduct}=="1010", MODE="0666"

    SUBSYSTEM=="usb", ATTR{idVendor}=="298d", ATTR{idProduct}=="2020", MODE="0666"

    SUBSYSTEM=="usb", ATTR{idVendor}=="298d", ATTR{idProduct}=="2024", MODE="0666"

    SUBSYSTEM=="usb", ATTR{idVendor}=="298d", ATTR{idProduct}=="ad00", MODE="0666"

  4. Copy the 60-nextbiometrics-usb-devices.rules file to the /etc/udev/rules.d using the following command:

    sudo cp <file path>/60-nextbiometrics-usb-devices.rules /etc/udev/rules.d/

    Replace <file path> with the actual path of the 60-nextbiometrics-usb-devices.rules file located on the network folder.

  5. Reload the rules to the following Linux platforms:

    • SUSE Linux Enterprise Server: sudo udevadm control --reload-rules

    • Fedora and RHEL:

      sudo udevadm control –reload

      sudo udevadm trigger

    • Ubuntu: sudo udevadm control –reload

    • Debian: sudo service udev restart

  6. Install the device service and its necessary components on your Linux workstation. For more information, see Installing Device Service on Linux.

  7. Navigate to /opt/NetIQ/Device Service/config.properties.

  8. Specify the following parameter:

    Table 3-1

    Parameter

    Description

    fingerprint.mode

    Set this parameter to 7.

    fingerprint.captureTimeout

    Set this parameter to the desired value to define the capture inactivity timeout in seconds. This parameter is optional. The default value is 15.

    Set this parameter to -1 to disable the timeout, which sets an infinite timeout.

    fingerprint.multifingerDevice

    Set this parameter to false to use single finger readers.

  9. Save the changes.

  10. Restart the Device Service.