(pwd)Extension-Mgr/SECKfmSwitchToIDFile and SMARTCARDS

HCL Domino Domino Forum
1

Does anyone have information who logging in with Smartcards (using enabled id-files) influences a pwd-extension manager and switching userid via SECKfmSwitchToIDFile?

can i hope that pin-code works as password in these cases?

Or do i have to use SECManipulateSC instead of SECKfmSwitch…, and an Extension Manager for EM_GETPASSWORD will never appear?

Is there a way to test this with eg a dummy dll?

anybody can help me? please:)?

thanks in advance,

John

2

Subject: (pwd)Extension-Mgr/SECKfmSwitchToIDFile and SMARTCARDS

A smartcard protected ID file cannot be unlocked with SECKFMSwitchToIDFile, and the extension manager will not be called for a smartcard-protected ID. You can SECManipulateSC to log in to a smartcard-enabled ID file. Here’s some fairly sloppy pseudocode for SECManipulateSC. As always, real code should check for errors and actually do something with return values. :slight_smile:

error = SECManipulateSC (SC_manip_GetVersion,

                         NULLSCMCTX,

			 NULL,

			 &Version,

			 NULL);

/* Initialize the PKCS#11 context.

*/

error = SECManipulateSC (SC_manip_InitializeContext,

			&Context,

			NULL, NULL, NULL);

/* Set up the ID file

*/

error = SECManipulateSC (SC_manip_EnterIDFile,

			&Context,

			 NULL, 

			&dwIDLen,

			IDPath);

/* Unlock the smartcard

*/

error = SECManipulateSC (SC_manip_EnterPIN,

			&Context,

			NULL,

			&dwPINLen,

			PIN);

/* Note – SC_manip_EnterPIN will use an external authentication path if it exists. If the token doesn’t support a protected authentcation path, SC_manip_EnterPIN will use the supplied PIN if one exists or generate a prompt if a NULL or zero-length PIN was used. */

…

/* Clean up

*/

SECManipulateSC (SC_manip_TerminateContext,

	   &Context, 

             NULL, NULL, NULL);
3

Subject: RE: (pwd)Extension-Mgr/SECKfmSwitchToIDFile and SMARTCARDS

thanks a lot.

the api.doc could tell more about this.

i can only hope the switching to id-files works similar to SECKFMSwitch… i use this function early at notes-start in a nsf-hook (was a lot of work to get this running in r6). i need this to get server-access (before certain things are locked,…).

i guess i have to check, if the id-file is SC-enabled by using SC_manip_EnterIDFile? there seems to be no other way. (KFM_IDFILE_TYPE_xxx has not been extended).

do you know i way to test it without having to buy a smartcard-reader? (its not the money, its the installation i fear:).

once again, thanks a lot,

sigi

4

Subject: RE: (pwd)Extension-Mgr/SECKfmSwitchToIDFile and SMARTCARDS

SC_manip_EnterIDFile can be used with an ID that is password protected, so that someone can call EnterIDFile, EnterPIN, and then SCEnableID to smartcard-enable the ID file.

The manner in which an ID file is locked doesn’t alter the structure or usage of the ID file itself, and so the KFM_IDFILE_TYPE code wouldn’t change for a smartcard-enabled ID any more than it would change for a multi-password protected ID.

You could try testing with a smartcard emulator in software, but I couldn’t really point you to any one in particular.

dave

5

Subject: RE: (pwd)Extension-Mgr/SECKfmSwitchToIDFile and SMARTCARDS

i got it now. this is “just” another layer of security. took me some time:).

now everything makes sense, thanks a lot.

John