RFID / Mifare self enrollment

[lmgtfy]

Does anyone know of a system be it hardware or software that would let a user login with their active directory credentials and then self enroll and associate a RFID / Mifare card writing back a value to their active directory account?

 

Background behind this is we have had Paxton Net2 installed with no consideration to how we are going to enroll nearly one thousand users :-(

 

We have Salamander who can create accounts in Paxton but associating 1000 cards as tokens is going to take an eternity.

 

Cheers

Edited October 15, 2020 by lmgtfy

[HPlum78]

Zebra do a number of printers that are able to print and read tokens, you can then assign the token back to AD if that's how your are managing identities.

[Chris_Cook]

Do you use these cards with any other system like cashless catering or copiers? Or is it bank and oyster cards they already have?

[lmgtfy]

Do you use these cards with any other system like cashless catering or copiers? Or is it bank and oyster cards they already have?

Yes Mifare cards are used with photocopiers currently which write back to papercut but there is no write back to active directory in order to populate this into Net2

[lmgtfy]

Do you use these cards with any other system like cashless catering or copiers? Or is it bank and oyster cards they already have?

Cool will look into this good idea

[robk]

Yes Mifare cards are used with photocopiers currently which write back to papercut but there is no write back to active directory in order to populate this into Net2

I wonder if you can export from papercut then import into ad.

 

Would be quicker than re-registering them all!

[caffrey]

Yes you can export from papercut, then just a simple powershell script to import them into AD like this :-

 

$names = Import-Csv C:\pagerps1\Pager.csv

ForEach ($Name in $Names)
{
  $FirstFilter  = $Name.givenname
   $SecondFilter = $Name.sn
   $pager=$name.Pager
   $found= Get-ADUser -Filter "GivenName -eq '$FirstFilter' -and Surname -eq '$SecondFilter'" 
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }

 

csv file contains givenName,sn,Pager as headers

 

Importing into paxton is

[robk]

Yes you can export from papercut, then just a simple powershell script to import them into AD like this :-

 

$names = Import-Csv C:\pagerps1\Pager.csv

ForEach ($Name in $Names)
{
  $FirstFilter  = $Name.givenname
   $SecondFilter = $Name.sn
   $pager=$name.Pager
   $found= Get-ADUser -Filter "GivenName -eq '$FirstFilter' -and Surname -eq '$SecondFilter'" 
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }

 

csv file contains givenName,sn,Pager as headers

 

Importing into paxton is

 

Thats what I had in mind.

 

Assuming Salamander is then able to read and convert the card no you should be good to go.

 

We populate pager with the card no for each user, then sync everything to that. NRS catering is "interesting" from that POV, but equitrac, Paxton, Inventry etc all work with a bit of scripting.

 

I understand papercut can sync from AD as well?

[caffrey]

Yes it can,

My work process is this :-

 

I print all cards from paxton for the year group

 

I have a master spreadsheet that does all the conversions for me which I scan the cards into using a desktop reader

I then export all users from Paxton, then modify that sheet with the card numbers from my master sheet then reimport

Then from the master spreadsheet I import into AD

Papercut then syncs with AD

 

It's a painful process but I haven't found an easier way to do it yet (I have a few ideas)

 

I have also missed the step how I get users into paxton, but I salamander is being used for that purpose here

Edited October 16, 2020 by caffrey

[Chris_Cook]

Once you have the RFID card serial number in AD, talk to salamander and they should be able to pull this into net2 for you.

 

For our setup, papercut uses the CSN in Hex format, paxton uses the same number converted to decimal and then takes the right most 8 characters from that.

[lmgtfy]

Yes you can export from papercut, then just a simple powershell script to import them into AD like this :-

 

$names = Import-Csv C:\pagerps1\Pager.csv

ForEach ($Name in $Names)
{
  $FirstFilter  = $Name.givenname
   $SecondFilter = $Name.sn
   $pager=$name.Pager
   $found= Get-ADUser -Filter "GivenName -eq '$FirstFilter' -and Surname -eq '$SecondFilter'" 
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }

 

csv file contains givenName,sn,Pager as headers

 

Importing into paxton is

 

Thanks this is looking like a really good solution. I believe I can get Papercut to schedule a report so if I can get the PowerShell script working with this report I should be able in theory to fully automate this. As you say Salamander can do the rest and convert it to a Paxton format Hex2Dec and whack it into Net2. I will let you know how I get on and share any modifications. Cheers

[lmgtfy]

Is anyone able to help me with my code @caffrey I have based it on yours which is working great but I'd love to add a if statement which only writes the value back if the Primary Card Number is 10 digits long.

 

So the CSV that Papercut outputs has these headers:

 

Username,Balance,Restricted,Full Name,Email,Department,Office,Primary Card Number,Notes,Secondary Card Number,Total Printed Pages,Jobs,Last activity,Created Date,Internal User,Other emails,Username alias

 

The only headers I'm interested in is Username and Primary Card Number so the Powershell code I have is

 

$names = Import-Csv D:\Documents\Papercut.csv

ForEach ($Name in $Names)
{
  $FirstFilter  = $Name.Username
   $pager=$name.'Primary Card Number'
   $found= Get-ADUser -Filter "cn -eq '$FirstFilter'"
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           Username     = $FirstFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }

 

 

Any help greatly appreciated.

 

 

Cheers

[caffrey]

Any reason for the 10 ?

 

 

You need a $pager.length -eq 10 somewhere maybe like this (On my code) - need to adapt to yours

 

$names = Import-Csv C:\pagerps1\Pager.csv

ForEach ($Name in $Names)
{
  
  $FirstFilter  = $Name.givenname
   $SecondFilter = $Name.sn
   $pager=$name.Pager
if ($pager.length -eq 10) {   

  $found= Get-ADUser -Filter "GivenName -eq '$FirstFilter' -and Surname -eq '$SecondFilter'" 
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }
  else
  
  	{      New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'SHORT CARD NUMBER'
  }
  }
  }

Edited October 17, 2020 by caffrey

[robyholmes]

Just be careful when storing numbers in AD if you then sync them to Office 365. Especially if you use a field like pager or phone number as it's visible to all.

[lmgtfy]

Any reason for the 10 ?

 

 

You need a $pager.length -eq 10 somewhere maybe like this (On my code) - need to adapt to yours

 

$names = Import-Csv C:\pagerps1\Pager.csv

ForEach ($Name in $Names)
{
  
  $FirstFilter  = $Name.givenname
   $SecondFilter = $Name.sn
   $pager=$name.Pager
if ($pager.length -eq 10) {   

  $found= Get-ADUser -Filter "GivenName -eq '$FirstFilter' -and Surname -eq '$SecondFilter'" 
   if($found){

   $found|Set-ADUser -Replace @{pager = $pager} -Verbose
     }
     

     else
   {
   New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'MISSING ACCOUNT'
           }
   
     }
     }
 else
 
 {      New-Object PSObject -Property @{
           GivenName      = $FirstFilter
           Surname        = $SecondFilter
           Status         = 'SHORT CARD NUMBER'
 }
 }
 }

Thanks ever so much one day I really must learn PowerShell properly. I can just about adapt code but anything else and I struggle.

 

The reason for the 10 is we have some other token types that have longer outputs that won't work with Net2 so no point transferring them over to ad.

[lmgtfy]

Just be careful when storing numbers in AD if you then sync them to Office 365. Especially if you use a field like pager or phone number as it's visible to all.

Good point I'll do some research it might be we populate either attribute. Cheers

[HPlum78]

As @robyholmes has said be careful where these are stored we use one of the extension attributes and hash them in our provisioning scripts to protect them even further, then when they are exported they are decrypted or in some cases the supplier has dealt with the decryption directly in the application for us.