There are two things that matter for PIN prompts: I assume you're talking about standard web browsers (IE/FF/Safari) and SSL authentication. There are two ways of doing smartcard client authentication on the web: standard TLS/SSL or custom plugins for the browser. So you'd need to find a way to invalidate the TLS session (not the application session, which is probably tied to an HTTP cookie) before requesting authentication, or direct the authentication request to another interface that doesn't have sessions enabled. Client authentication won't happen if there's a valid TLS session. On the server side, a complete handshake has to occur in order to make the client perform authentication. But, with newer systems, it should not be an issue. This is something you wouldn't have control over, unless you manage the users' machines there's no HTTP header or TLS option that you can use to enforce PIN entry. This "feature" could compromise security, so my guess is that it was deliberately removed and there wouldn't be any registry hacks or otherwise to restore the behavior.
Cac middleware activclient windows#
I haven't found anything like this in Windows built-in PIV support. I think that ActivClient was doing this with its PIN caching feature through version 6, but in version 7, this option seems to have gone missing. The middleware on the machine talking to the card could also cache the PIN, and provide it to the card whenever the card indicates that it requires a PIN before it will complete an operation. You might be able to require a particular OID in extended key usage, or exclude some of the DoD intermediate certificates from path building (flagging them as revoked, perhaps). Thus, you'd need to find which keys have this "always verify" flag set, and configure the path validator on the service to accept only those keys. I haven't checked, but I think this is set for the "email" key pair on a CAC. Beyond that, each key on the card has a flag that indicates whether the PIN has to be entered every time the key is used. To perform a digital signature, the CAC has to be in a "verified" state, meaning a PIN was entered after the card was inserted.
Cac middleware activclient software#
DoD CAC Middleware Requirement v3.0.There's a few different pieces of software involved here.įirst is the card itself.
The next generation of ActivCard® Gold™ for CAC, the leading smart card-based strong authentication software for the DOD Common Access Card enables usage of PKI certificates and keys on a CAC to secure desktop applications, network login, remote access, web login, e-mail and electronic transactions.
ActivClient™ CAC is the latest Common Access Card (CAC) middleware from ActivIdentity that allows US Department of Defense agencies to easily use CAC smart cards for a wide variety of desktop, network security and productivity applications.
0 kommentar(er)
