Novell Enhanced Smart Card Method 3.0.1, Installation Manual

Page: 22 / 46

22 Novell Enhanced Smart Card Method Installation Guide
no
vd
ocx
(e
n)
6 Ap
ril 20
07
3.4 Smart Card Interface
The method can communicate with the smart card using PC/SC interfaces or PKCS#11 interfaces.
When using PC/SC interfaces, the smart card middleware vendor provides an MS CAPI provider.
The method can automatically detect and use the proper MS CAPI provider. PC/SC mode is the
recommended setting and should work with most smart card middleware on Windows.
If PC/SC communication is failing, you might want to try PKCS#11. When using PKCS#11, you
must specify the correct vendor PKCS#11 DLL. The library must be in the system path so it can be
loaded by the method. You might need to contact the middleware vendor for the specific PKCS#11
library name. Below is a table of common PKCS#11 libraries.
Table 3-1
Common Vendors and PKCS#11 Libraries
3.5 Novell Client Single Sign-On
When using the smart card method, users enter the card's PIN for eDirectory login and are then
prompted to enter a password for the workstation login. Novell Client's Single Sign-On feature can
be used to automatically log into the workstation after the eDirectory login. This is accomplished by
securely storing the workstation credentials in eDirectory and using them for future logins.
When using Single Sign-On, Novell Client prompts for the workstation password the first time and
stores it in eDirectory. On subsequent logins, the user is not prompted for the workstation password.
This improves the user's login experience and is recommended for all advanced eDirectory
authentication methods.
3.6 Novell Client Passive Mode Login
Passive Mode Login is new functionality added to Novell Client 4.91 SP3. In passive mode, Novell
Client defers to the default MS GINA for the initial Windows login. After authentication to the
workstation, Novell Client attempts to authenticate to the Novell environment. The functionality
was added to Novell Client to allow environments that use Windows AD smart card authentication
to function correctly. It allows the smart card to be used to authenticate to AD and eDirectory.
In passive mode, the Windows user name used for workstation authentication is also used for
eDirectory authentication. In order to successfully authenticate, the user name must exist in
eDirectory, and the client's default location profile must be properly configured with the Tree and
Context information.
Vendor PKCS#11 Library Name
Active Card
acpkcs211.dll
Netsign
core32.dll
GemPlus
gclib.dll
eToken
eTpkcs11.dll
CryptoVision
cvP11.dll
Rainbow iKey
ckdk201.dll
(Only PCKS#11 mode is functional
for iKey devices)