Problems using SECManipulateSC (need help, dave kern?;)

hcl-bot · October 8, 2003, 10:09am

I have a smartcard enabled id, no problems i have noticed so far working with this id (notes native).

Now i’d like to test switching to a SC-ID using SECManipulateSC. GetVersion (SEC_Manip_GetVersion) as first parameter (OpCode) works fine.

Next step (Initialize context) fails. (Access Violation).

SCMCTX Context;

error = SECManipulateSC (SC_Manip_InitializeContext, &Context, NULL, NULL, NULL);

i was expecting, that notes reserves some space for the context needed and returns a pointer.

(SCMCTX only defined in kfm.h as typedef void far *SCMCTX;).

tried to alloc space for pContext myself, this worked (without crashing) but it returned 0x1708 (“Bad Security Context…”).

Am i mixing up something?

did someone get it to work? and how?

by the way, extension manager is! called with smartcard-enabled ids.

what i also really need is an easy way to tell, if an id-file has been sc-enabled.

thanks, John

hcl-bot · October 8, 2003, 1:08pm

Subject: Try initializing Context to NULLSCMCTX

Try initializing Context to NULLSCMCTX and see if that solves the problem.

If you call SECManipulateSC with a non-null, non-initialized context for any function but SC_manip_GetVersion, it should return ERR_BSAFE_BADCTX (0x1708). However, if Context points to an invalid section of memory, you’ll probably get an access violation.

SCMCTX Context = NULLSCMCTX;

error = SECManipulateSC (SC_manip_InitializeContext, &Context, NULL, NULL, NULL);

A check of the documentation shows that it does state that the context must be initialized to NULLSCMCTX, but it could definitely be clearer. I’ll see if I can get that wording improved…

“pContext - Address of a NULLSCMCTX. See NULLSCMCTX”

by the way, extension manager is! called with smartcard-enabled ids.

The extension manager may be called, but you probably won’t have much luck unlocking a smartcard-protected ID through that route, at least not currently. Would you find it useful to be able to unlock a smartcard-protected ID file by placing the PIN in an extension manager callout, should that functionality be added to a future release?

what i also really need is an easy way to tell, if an id-file has been sc-enabled.

I don’t believe that there are currently any single functions in the C API that will reveal if an ID file is smartcard-protected. That being said, you can call SC_manip_InitializeContext, then SC_manip_EnterIDFile, then SC_manip_PushInetKey to achieve the same purpose. SC_manip_PushInetKey will fail, because the smartcard was never unlocked with SC_manip_EnterPIN. However, if the ID file is not smartcard-enabled, PushInetKey will return “The password for this ID file is not stored on a smartcard.” If the ID file is smartcard-enabled, PushInetKey will return “Incorrect PIN”.

Hope that helps,

dave

hcl-bot · October 8, 2003, 4:39pm

Subject: RE: Try initializing Context to NULLSCMCTX

First of all, thanks a lot. Setting Context to NULLSCMCTX (0/NULL) within the first call to SECManipulateSC solved this issue, this was my fault.

What i was looking initially was a way to switch to a differnt id like SECKFMSwitchToID does for non SC-ids. It becomes clearer now (if i am right), that using SECManipulateSC is just for sc-enable ids, get/set certifiers…

although the documentation states that “…_EnterIDFile … stores the hKFC in SCMCTX”. i guess this could maybe passed to low level api functions, but there is nothing in the documentation (maybe REGSwitchID does the trick?).

am i wrong? i tried accessing servers after (sucessfully) entering the correct pin using SECManipulateSC, but no luck.

next thing is, that the extension manager is called every time as if for non sc-ids, which i would call a bug:). this will render all extmgrs using external passwords useless (trying to check if its a sc-id as you suggested also takes much time with slow cards, 6-8secs in my case).

won’t you tell me i am completly wrong and make my day:)?

thanks, John

hcl-bot · October 31, 2003, 3:48pm

Subject: EM_GETPASSWORD with smartcard-protected ID files

next thing is, that the extension manager is called every time as if for non sc-ids, which i would call a bug:). this will render all extmgrs using external passwords useless (trying to check if its a sc-id as you suggested also takes much time with slow cards, 6-8secs in my case).

Yes, I’d call that a bug, too, and I’ve fixed it. You’ll be able to use EM_GETPASSWORD extension manager callouts to unlock smartcard-protected IDs by passing the smartcard’s PIN in through the extension manager in 6.0.4 and 6.5.1.

Hope that helps,

dave

hcl-bot · October 8, 2003, 5:15pm

Subject: RE: Try initializing Context to NULLSCMCTX

What i was looking initially was a way to switch to a differnt id like SECKFMSwitchToID does for non SC-ids. It becomes clearer now (if i am right), that using SECManipulateSC is just for sc-enable ids, get/set certifiers…

Correct. SECManipulateSC is a “utility” function that can be used to manipulate the smartcard-related aspects of an ID file, including smartcard-enabling ID files and importing/exporting certificates and keys. It manipulates its own copy of the ID file, not the “current” ID file.

am i wrong? i tried accessing servers after (sucessfully) entering the correct pin using SECManipulateSC, but no luck.

You should be able to use the same C API calls to open and switch between smartcard-protected ID files that you use for regular ID files – the main difference being that Notes will prompt you for the token’s PIN instead of the ID file’s password. I have a number of test programs of my own that use the C API, and don’t have any problems prompting for the PIN when an ID file is smartcard-enabled.

next thing is, that the extension manager is called every time as if for non sc-ids, which i would call a bug:).

I would call that a bug, too. The extension manager should either not be called, or should be capable of sending a PIN to Notes and unlocking the ID file. I’ve written an SPR for that problem.

(trying to check if its a sc-id as you suggested also takes much time with slow cards, 6-8secs in my case).

That’s the time involved in initializing the token… smartcards tend to be slow. Also SPR’d.

dave

hcl-bot · October 8, 2003, 9:19pm

Subject: RE: Try initializing Context to NULLSCMCTX

You should be able to use the same C API calls to open and switch between>smartcard-protected ID files that you use for regular ID files – the

main difference being that Notes will prompt you for the token’s PIN

instead of the ID file’s password. I have a number of test programs

of my own that use the C API, and don’t have any problems prompting

for the PIN when an ID file is smartcard-enabled.

How could I use e.g. SECKFMSwitchToIDFile, where i have to pass the password-string as parameter? What else could i do to switch to different ids apart from using either REGSwitchToID/SECKFMSwitchToIDFile?

Looks as if these functions haven’t been altered to reflect the added sc-functionality.

This smartcard thing looks a bit premature, doesn’t fit in the notes environment at all.

Thanks again, John

hcl-bot · October 10, 2003, 2:31pm

Subject: Set pPassword to NULL

How could I use e.g. SECKFMSwitchToIDFile, where i have to pass the password-string as parameter? What else could i do to switch to different ids apart from using either REGSwitchToID/SECKFMSwitchToIDFile?

Actually, the password string in SECKFMSwitchToIDFile is an optional parameter. Try setting pPassword to NULL and experimenting with some of the InputFlags. You should be able to cause SECKFMSwitchToIDFile to prompt for the password/pin, or for the prompt to even be delayed until you try to access any of the encrypted parts of the ID file.

dave

hcl-bot · October 9, 2003, 10:28am

Subject: RE: Try initializing Context to NULLSCMCTX

Tested using SC-IDs with SECKFMSwitch/RegSwitch… the problem is, that the time when i use this functions, there is just a prompt-handler using a Notes Debug Window (command like), but who knows, maybe i can set a prompt handler myself.

hcl-bot · October 10, 2003, 2:19pm

Subject: That’s the standard console prompt

The prompt that you are seeing is the standard console prompt, which is used by the server and by most API-based console applications. There are also graphical console prompts available for windows boxen and macs.

dave