IA Registry Editor Tool v2.2

The IA Registry Editor Tool is designed to provide a configurable, easy to use mechanism which allows users to switch the environment their Identity Agent will use for authentication. The tool can be configured to work with any variation of Identity Agent on any version of Windows. 

The Registry Editor Tool can help you configure your workstation to access these Path to Live environments quickly and easily:

• Development - for early phase testing
• Integration - for integration testing
• Deployment - for user acceptance testing
• Training - for training users in Spine and e-RS applications and processes

Once you have downloaded the tools and followed the configuration instructions, visit Path to Live environments for more information and support.

The link below downloads a single executable file which can be run directly from any location as an admin user.

Download IA Registry Editor tool (requires HSCN connection) 

The tool is designed to be simple to use, but does require the user to have administrative rights on the machine for it to work.

Note

These applications are hosted on the DIR downloads page. To access this site, you must have a secure NHS HSCN Connection. If for example, you are using a personal laptop, or not connected via VPN when working from home, this will be the reason you see a blank page or page not found error.

Spine provides the infrastructure that enables increased patient safety, improved quality of healthcare, greater clinical effectiveness and better administrative efficiency. 

To gain access to various Spine Environment and 3rd party applications, users are required to switch the registries on their local machine which can be used by the installed Identity Agent to point to the correct environment for the task being performed. In many cases if these registries are missing or incorrect, this can cause problems with authentication itself.

Currently we have two ways of updating registries to point to the appropriate environments:

1. Update manually with admin rights
2. Use the existing IA config tool which requires admin rights to install and does not support all versions of Identity Agent

This tool can be run by the user to switch easily between environments. The current tools available do not support all the current Identity Agents. The new IA Registry Editor Tool supports only NHSD IA v2.x (all versions).

Note: Please be aware that if your Trust controls the Identity Agent registry via policies, you will need to refer to your local ICT department to change the environment you are trying to authenticate against.

Step 1. Run / Execute IARegistryEditorTool.Exe with Admin Rights

Step 2. Select the required Registry Path and any options if applicable

Step 3. Select the required environment

Step 4. Click on the Apply button

Step 5. Click the Ok button for the registry update success message and the tool will close

Step 6. Restart Identity Agent will be done automatically.

NOTE: The tool may appear to flicker, this is due to the program checking the state of the check boxes a few times per second. We have tried to balance the refresh time with how quickly the check boxes are updated so the tool doesn’t seem slow to respond. This is normal behaviour.

Ask your local IT team to place the Registry Editor Tool on your desktop via Software Centre. This will allow you to use the tool without needing admin rights to change the registry. You will need to provide the IT team with the asset number and hostname of your machine.

The IA Registry Editor Tool is expected to be provided to and executed by NHS users. Whilst it does require an 'Admin' level of privilege to execute, the end-user in question may be blocked from running .exe files via local Group Policy. In this case, to use the tool, the user will need that constraint removing (likely by their local IT / deployment team).

If the user attempts to change the registry and they are non-admin, they will under normal circumstances be prompted for the Username / Password of an admin user. If, however the machine does not have UAC enabled and the user tries to update the registry, they will get the error below and the program will exit. No changes will be made to the registry.

When the tool is launched, the user will be presented with the application window as shown in the screen shot below.

By default, the tool will update the registry with the settings for Identity Agent v2.x with the following config.

1. Registry Path – HKLM (All User)
2. Authenticate against the Live environment
3. Identity Agent Type – NHS Digital IA v2.x
4. Close all browser sessions when logging out of Spine
5. Not set any hard-coded value for card removal check
6. User type – Non RA Users

The tool supports the choice of Live plus four PTL environments
1. INT – Integration
2. DEV – Development
3. DEP – Deployment
4. TRN – Training

The tool supports the use of only latest versions of Identity Agent
1. NHS Digital Identity Agent v2.x

The tool supports the setting of card removal check to be False. This is required for RA’s only and a warning is given when this setting is chosen. When selecting this option, the tool will only allow the Identity Agent to have the settings for Normal mode and all other operating modes are greyed out and set to false for NHSD Identity Agent v2.x.

The tool supports the setting of all the available modes in which Identity Agent v2.x supports. See the Identity Agent Administrators Guide for further information on these modes.

The tool will allow the user not to close all browser sessions when logging out of Spine. The user is prompted with a potential security warning when this option is selected as clinical data may be left on screen and visible to unauthorised users with this selection.

The tool will allow the user to specify certificates need to delete from personal certificate store to be consider during card removal.

The screen show below shows the tool with all options and warnings visible for completeness.

Operating System Architecture

The tool will determine the Operating System architecture of the machine automatically and update the relevant registry entry as appropriate without the user needing to know this information.

e.g. 32-bit HSCIC or NHS Digital Identity Agent:

HKEY_LOCAL_MACHINE\SOFTWARE\HSCIC\Identity Agent

And 64-bit is:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HSCIC\Identity Agent

More details can be found in Identity Agent Administrator guide

https://nww.digital.nhs.uk/dir/downloads/nhs-digital-ia-v2.4.6.0-release-documentation-issue-1.zip

NHS Identity Agent

How to set up a smartcard user workstation

How to set up a Registration Authority workstation