Settings

This value is only used when no start parameters is given for the main loader component.

This value is only used when no start parameter is given for the Watch component.

Default start parameter for App command.

All entries except those used for presentation may have different values depending on Windows version. A value with version number as a postfix will only apply to that version of Windows.

Presentation will be based on the information from [Dialog Presentation], but if presentation should be different it will be possible to specify the same entries in this section.

This entry specifies whether Credential Provider should be enabled or not.

Default value is 1, Credential Provider is available, will still require that the configuration section is present and the component is available.

This entry specifies a list of applications that will not use the Credential Provider. Use semicolon (;) to separate the applications.
By default the list is empty; all applications will use Credential Provider.

This entry specifies the automatically logon behavior in situations where there is only a single credential available and the PIN already has been entered. The dialog will be shown but the PIN entry will be automatically filled and the OK button will automatically be pressed.

Default value is 0; automatically logon is disabled.

This entry is used to prompt PIN for Credential Provider.

Default value is 3; prompt PIN for all scenarios.

This entry specifies a list of applications that should not use the automatically logon feature. Use semicolon (;) to separate the applications. Default Windows logon applications logonui.exe;lsass.exe.

This entry is used to force a PIN change for Credential Provider. Used together with PinExpire in SmartCard section.

Default value is 3; force PIN change for all scenarios.

This entry specifies the mode of operation, either pass-through provider or full provider. The pass-through provider will intercept the Microsoft standard provider and modify the behavior, but the full provider will implement all functionality itself and will not rely on anything else.
To make the full provider work as expected for all available parameters it is also necessary with some additional configurations that will not be described.

Default value is 0; will use pass-through provider.

Full CredentialProvider Mode.

This entry specifies the guid for the provider that should be wrapped when used in pass-through mode.
The default value will wrap Microsoft standard providers and is depending on provider scenario and Windows version.

This entry specifies the guid which should be blocked. Default will block a possible provider that is wrapped when using pass-through, but this entry may also specify additional providers.

This entry specifies a list of issuers of user certificates that are allowed to be used in Credential Provider, no other certificates will be shown. The configuration is only valid with the full provider.
Default none; certificates from all issuers are shown.

This entry specifies a list of issuers that will be used when deciding which user certificate that should be considered as the default certificate in Credential Provider. Will set the certificate that is matching the most prioritized value in the list as default. The values in the list are prioritized from left to right. The configuration is only valid with the full provider.
Default none; no default certificate defined.

This entry specifies a list of issuers of user certificates that are not allowed to be used in Credential Provider, all other certificates will be shown. The configuration is only valid with the full provider.
Default none; certificates from all issuers are shown.

This entry is used to remember last used credential for LogonUI and CredUI. Max 10 credentials.

Default value is 0; Will not remember last used credential.

This entry specifies whether Certificate Provider should be enabled or not.

Default value is 1, Certificate Provider is available, will still require that the configuration section is present and the component is available.

This entry specifies a list of applications that will not use the Certificate Provider. Use ; to separate the applications.
By default the list is empty; all applications will use Certificate Provider.

These entries are used to generate the certificate request and the value is depending on the LRA component, see LRA documentation for more information.

This entry tells whether challenge/response should be used when unlocking the PIN. The smart card to be enrolled may be locked for security reasons.

Default value is 0; normal PUK is used to unlock PIN.

This entry tells the number of seconds a challenge should be valid when using challenge/response mode.

This entry tells whether the smart card always should be unlocked during enrollment.

Default value is 0; will unlock smart card when locked.

This entry specifies whether Pin Provider should be enabled or not.

This entry specifies the automatically logon behavior in situations where there is only a single credential available and the PIN already has been entered. The dialog will be shown but the PIN entry will be automatically filled and the ok button will automatically be pressed.

Default value is 0; automatically logon is disabled.

This entry specifies a list of applications that should not use the automatically logon feature. Use ; to separate the applications. Default Windows logon applications "logonui.exe;lsass.exe".

DisableAutoLogon=lsass.exe;logonui.exe

This entry is used to force a PIN change for Pin Provider. Used together with PinExpire in SmartCard section.

Default value is 3; force PIN change for all scenarios.

This entry tells whether challenge/response should be used when unlocking the PIN.

Default value is 0; normal PUK used to unlock PIN.

This entry tells the number of seconds a challenge should be valid when using challenge/response mode.

This entry will enable/disable usage of both key set types for internal key container format. Some CryptoAPI applications will not check for correct values in the certificate store instead assume the key type.

Default value is 0; only correct key set may be retrieved.

This entry specifies a list of issuers which will be registered in user store for CryptoAPI, use ; to separate different issuers. Default none, all certificate are registered.

This entry can be used to limit extended usage for duplicate certificates. Specify object identifier for the extended usages that should be allowed, separate with ';'. Use text string <none> to allow nothing. Default empty, no special handling for duplicate certificates.

This entry can be used to enable/disable writing of certificate/container information to a cache file. The cache is used by Credential Provider when it is used in pass-through mode. Microsoft has some limitations regarding multiple access, so this is used to avoid extra access from the Credential Provider towards the CSP when used with Microsoft Provider.

Default value is 1; certificate information is written.

This entry is used to sort certificates for CSP via PP_USERCERT_STORE.

This entry will enable/disable clear of user PIN cache by the internal certificate propagation service.

Default value is 2; will clear user PIN cache for all users.

This entry specifies a list of applications, separated by using ;, that will have their own PCSC connection from CSP.

Default none; no applications will be handled.

This entry specifies the name format of the container representing certificates and corresponding private key.

Default value is 0; 'thumbprint (slotid)'.

This entry will enable/disable deletion of old key set when generating a new key.

Default value is 0; will not delete key set.

This entry specifies a list of issuers which will not be registered in user store for CryptoAPI, use ; to separate different issuers. Default none; all certificates are registered.

This entry will enable/disable showing of insert card dialog when requested smart card is not present.

Default value is 0; will show insert card dialog when needed.

This entry will try to enable/disable use of non-repudiation certificates for Microsoft CryptoAPI.

Default value is 1; will try to disable use of non-repudiation certificates.

This entry will enable/disable use of Net iD CSP for generating random values.

Default value is 1; will allow generating of random values.

This entry will enable/disable check of CRYPT_SILENT flag when creating new CryptoAPI contexts with CryptAcquireContext. Setting the CRYPT_SILENT flag when creating new CryptoAPI context means that the calling application will not allow the CSP to show any dialogs.

Default value is 0; will check silent flag.

This entry is used to enable/disable to storage of certificates in CryptoAPI user store.

Default value is 1; will register certificate in CryptoAPI user store.

This entry is used to register a friendly name for the certificate in CryptoAPI user certificate store. The following wild cards may be used:

Label is the certificate label stored with the certificate object, issuer and subject are any of the object identifiers available in the subject or issuer field from the certificate. Any combination of static text and wild cards above may be used.

Default value is "%subject.2.5.4.3% (%issuer.2.5.4.3%)".

This entry is used to initialize a change PIN dialog, when PIN is about to expire.

Default value is 0; no change PIN dialog.

This entry can be used to control installation of CA certificates to CryptoAPI store.

Default value is 1; will install CA certificates.

This entry can be used to enable/disable loading of Net iD Enterprise main library directly when the CSP is loaded. This may increase performance, but may cause unloading to be slightly slower.

Default value is 0; will not load external.

This entry is used to control loading and unloading of the CSP, when enabled the CSP library will not be unloaded. This was recommended by Microsoft for enhanced performance, but is no longer recommended by Microsoft.

Default value is 1; will load myself.

This entry is used to control the behavior of certificate storage when a smart card is removed. Normally certificates will be removed from CryptoAPI user certificate store when smart cards are removed.

Default value is 0; will not keep any certificates.

This entry is used to control the behavior of CryptoAPI contexts. Normally the PKCS#11 sessions will be closed as soon as the context is released, using this parameter will cause the session to be alive and wait for a new identical session. This behavior may increase performance.

It is also possible to specify a list of application names instead of 1, specified applications will have value 1 (all other 0).

Default value is 0; will not keep session alive.

KeepSessionAlive=iexplore.exe;lsass.exe

This entry is used as prefix for names when registered for smart card logon during installation.
Default value is empty; none.

This entry is used to control the behavior of registering certificates in CryptoAPI stores. Normally Net iD Enterprise always will try to register the certificates to Net iD CSP, even if another CSP already has registered the certificate.

Default value is 1; will overwrite certificate.

This entry is used to control the behavior of registering certificates in CryptoAPI stores. Normally Net iD Enterprise always will try to register the certificate both for the user and the machine. This will allow applications running in system environment to use the certificate.

Default value is 1; will try to publish in machine store.

This entry is used to control the behavior when writing certificates with the CSP. Normally we only write the certificate, but this parameter may be used to initiate a search for identical certificates and remove those if found. Identical means same issuer/subject/key.

Default value is 0; will not replace certificate.

This entry is used to when the container name has a special meaning for the calling application and needs to be used for future calls, i.e. Entrust. This will limit the use of secondary certificates and should be avoided.

Default value is 0; container name is automatically generated.

This entry is used to add a critical section for all CryptoAPI contexts. This should normally not be needed, since the same context should not be used by multiple threads simultaneously. It will also be possible to add a global critical section, this will only allow one single thread at each time to access the CSP.

Default value is 1; will add a critical section.

This entry will enable/disable validation of certificates before registration in CryptoAPI store. The validation is only made on the certificate value and signature if the CA certificate is available, no check is made regarding certificate revocation.

Default value is 0; will not verify certificate.

This entry will enable/disable advanced dialogs for the old user interface. The advanced dialogs will include a bitmap representing the certificate used; see Dialog Image

Default value is 1; will always try to use advanced dialogs.

For a specified list of applications this entry will disable the user interface to be shown in the same process as the application itself. An attempt to show the user interface will instead create a separate process that will show the user interface, for example a PIN dialog.

Default value is "lsass.exe;iexplore.exe;firefox.exe;chrome.exe;"

This entry will enable/disable redirection of open dialog requests to another process; the value is a full path to any application.

This entry specifies the full path to an application that should be used to show the web-based user interface. The parameter is required when a dialog is started from within an Internet Explorer session, since Internet Explorer will interfere with the user interface. The recommended value is the internal loader.

This entry specifies a list of applications that should not use another application to show the user interface. Use ; to separate the applications.

Default is none; all applications will use another application when enabled.

This entry specifies the full path to the location containing the web-based user interface. The recommended value is within the installation directory.

This entry specifies the theme that should be used by the web-based user interface. This will be translated to a parameter when opening the dialog and the real meaning will be decided by the implementation of the web-based user interface.

This entry is the same as Theme, but specifies the theme that should be used for a specific Microsoft Windows version.

Default value is Theme_v62; Windows 8.

This entry specifies the number of minutes the web-based dialog should be shown until it is automatically closed when using another application to show the user interface

Default value is 10; 10 minutes.

The web-based user interface will require configuration for each dialog that will be shown. The following list is currently available:

It is also possible to add custom utility dialogs started via main loader:

All entries have the following format:

The <file> value is either a full URL to any location or relative to the PathResource parameter:

The <size> value is a hexadecimal digit where the first four digits specify the dialog width (pixels) and the last four digits specify the dialog height (pixels).

The <dynamic> value is used when calculating the dialog height based on dynamic content, i.e. select certificate may contain one or more certificates. The value is hexadecimal digit where the first four digits tells the number of objects that was used for the <size> parameter and the last four digits tells the number of pixels that should be added/removed for each object.

The <extra> value specifies other useful parameters, the current available list of parameters:

There are endless possibilities to customize the dialogs, since the web-based interface and the plugin object are available. The actual parameters for each type of dialog are not documented and may be updated for each future version. The best approach is to check the web pages for the delivered user interface and modify it. The parameters will probably not change until next major release, but there is no guaranty, even a minor update may change/add/remove parameters.

To handle different strings for different language entries: Title, SubTitle, TextAbove and TextBelow may be prefixed with a short name of the language.

To handle different strings for different type of certificates: Image, Title, SubTitle, TextAbove and TextBelow may be specified with multiple choices, first combination that generates a non-empty string will be used. Separate with ; and will check from left to right.

This entry specifies a list of images which may be used to display a certificate, bmp and ico files are supported. Use the wild cards above, wild cards will always be replaced, not found will generate an empty value. The search will try to find an entry in the same section with the generated string after wild card replacement.

or

It is also possible to specify a nomatch and default image that will be shown for unknown certificates, without this entry Microsoft standard bitmap will be used.

Unknown certificate means that the certificate is external, or that no smart card is present.

This entry specifies the title for selection entry. Use any combination of static text and wild cards above.

Default value is certificate common name. This value is always visible.

This entry specifies the subtitle for selection entry. Use any combination of static text and wild cards above.

Default value is static text "Smart card logon", translated to local language. This value is always visible.

This entry specifies an extra text field for the selection entry, located above the PIN entry edit field. Use any combination of static text and wild cards above.

Default value is user principle name from the certificate. This value is visible when selection entry is selected.

This entry specifies an extra text field for selection entry, located below the PIN entry edit field. Use any combination of static text and wild cards above.

Default value is none. This value is visible when selection entry is selected.

This entry will enable/disable the use of dynamic strings.

Any string may be replaced and they are identified by the short language name and the resource string id.

You may retrieve the available resource string IDs by calling

This entry specifies the default encryption format of the created encrypted message. Useful when encryption format is not specified, for example when used with Windows Explorer.

Default value is 0; encrypted message is according to the PKCS#7.

This entry specifies the default file extension when encrypting files.

Encrypt=p7m

Default value is p7m.

This entry specifies the default file extension when signing files.

Sign=p7s

Default value is p7s.

Use this parameter to get a warning message when a CA has expired. Specify common name from the issuer field, use ; to set multiple issuers. Default none, no warning message.

Use this parameter to get a warning message when a smart card is about to expire or has expired. Specify the number of days before the expiry that the message should be shown. It is also possible to specify a specific issuer name to only check certificates from a certain issuer and ignore all other certificates, separate with ,. May also specify a list of number of days and issuer names, separate with ;.

The card is about to expire when there is no certificate available with a validity that is longer than the specified number of days added to the current date.

Default value is 0; no warning message.

The warning message may be replaced with a custom action dialog, see Links Action for more information.

Use this parameter to get an event when a smart card without any or a specific certificate is inserted. The value may specify a token model name and token serial number followed by the CA which is wanted. All values may be empty, which means that any smart card without certificates will generate an enroll event. Token model name requires a complete string match and token number requires a start string match. May also specify a list of values, separate with ;.

There is no warning message dialog, but it is possible to specify a custom action dialog, see Links Action for more information.

Identical to CheckCardExpire, but will check soft tokens instead of smart cards.

Use this parameter to enable/disable register of supported smart cards in Registry.

Smart cards must be registered to handle CryptoAPI applications using smart card reader names when connecting towards the CSP. Typical applications are Microsoft smart card logon on all Windows platforms.

Default value is 1; smart cards are registered.

Use this parameter to listen to custom events. The value is a list of event names separated with ; and the action is specified in section [Event <name>].

The event is generated by calling the main loader component.

There is also a special INTERNAL event, the name must still be specified in the list if used. The INTERNAL event will start the event by using the main loader.

This command will show the about box in the background service context.

Use this parameter to specify which applications that enables/disables extending of some menu entries for Windows Explorer.

[General]
ExplorerExtension=explorer.exe

Default value is none; No applications will be configured.

Use this parameter to enable/disable extending of some menu entries for Windows Explorer.

Default value is 1; Explorer menu is available.

Use this parameter to configure a list of services that will be started/stopped by CertMover. Services in the list are separated by semicolon.
Default value is none; No services will be configured.

Use this parameter to enable/disable installation of short cuts in the start menu.

Default value is 1; start menu entries are available.

Use this parameter to set access mode for the background service when moving certificates to CryptAPI store. The moving will be initiated by checking the smart card insert/remove event or via polling. The polling will occur each ten seconds, and the insert/remove event may be checked via PC/SC or PKCS#11.

There are also two different modes for reading certificates when a event is detected via mode above, either using PKCS#11 or CSP.

Those two values are added for the complete access value.

Default value is 0x13.

Use this parameter to show/hide the taskbar icon. The task bar icon will contain a menu with some short cuts for common tasks, see TaskbarMenuMode below for more information. The taskbar icon will also show progress when cards are inserted or removed.

Default value is 1; task bar icon is visible.

Use this parameter to limit the number of components that should be visible on the taskbar menu.

Combine the bitmasks with OR operation to select which components that should be visible. For example, to show all above:

TaskbarMenuMode=0x07DF

Default value is 0x07Df; all components are visible.

Use this parameter to install the certificate service as a Windows service or a background process. The certificate service is the process which may show a taskbar icon with menu.

Default value is 1; certificate service is installed as a Windows service.

This entry specifies the build or rather the installation package information. Any string value is acceptable, but there are some recommendations, more information is available through your support contact.

This entry contains the full path to the configuration. This value is usually not specified, will use default based on what is suitable for each platform. For Windows platforms the default location is a configuration file in the installation folder, but it may be useful to move the entire configuration to Registry to be able to use GPO.

If the Registry is used software\policies will always be read first to check for GPO settings before other configurations are read. At the moment this only applies for a limited number of configurations that are included in the GPO policy template supplied by SecMaker.

Example of read order in Registry:

This entry contains the full path to the current installation.

This entry contains the product name used by an OEM installation.

This entry contains a list of installed product names, used during uninstall to remove everything after an upgrade between OEM and normal installation.

This entry contains the complete version number in eight digits, two for each part:

The <major> and <minor> values specify a release, for example 05 and 04 for release 5.4.

The <fix> number always starts from 0 for first release and if there is any eventual problems found for the release which requires a new version, this value is increased, for example first fix for 5.4 is 5.4.1.

The <build> number starts from 1 for first build for a specific <major> and <minor> value. This value is increased for each delivered build. For example, for 5.4 was the first BETA 5.4.0.10, first RC was 5.4.0.20. The final 5.4 and 5.4.1 releases have the values 5.4.0.26 respective 5.4.1.34.

This entry specifies the behavior during upgrade, whether a configuration should be merged or overwritten.

Default value is 1; configuration will be merged during upgrade.

This entry specifies the behavior during upgrade, whether the installation should remove old installation before a possible upgrade.

Default value is 0; installation is upgraded.

This entry is used to hide/show different wizard pages during installations, but some pages will always be available. The value is a bitmask, enable bits to show the page:

Default value is 0xFF; show all pages.

This entry specifies the build information. There are three standard types defined, but any string value is acceptable. No value at all, means standard release:

UD build is completely unsupported; should only be used when testing some special feature.

BETA build is not usually supported; all functionality for the coming release is present, but only development tests have been performed.

RC build is usually not supported; all functionality for the coming release is present, but only sanity tests have been performed, not complete system tests.

This entry specifies a list of supported languages, separate with ;. This list can be used to limit the number of supported languages. It is also possible to set a new name for the language. Format:

Allowed=<language name>[:<new language name>];

Default value is none; all supported languages will be available.

This entry contains the current language, may also specify the string auto to use the current local language on the computer.

Current=English

Default language is English. Any unsupported language or invalid language string will use the default language.

This entry specifies a list of accepted smart cards defined by ATR. Seperated with ";".

Cards=123456ABCDEF;ABCDEF123456

This entry specifies the company name of the license.

Company=SecMaker AB

This entry specifies a list of accepted certificates.

Issuers=O=SecMaker*

This entry specifies the user name of the license.

Name=DEMO ONLY

This entry specifies the license value.

Value=WagC-YmLC-emxh-lyne-iMvT-JKE8

This entry controls the administration start parameter.

Admin=-admin

Admin=http://www.secmaker.com/admin

Default value is -admin; starts Administration GUI.

This entry will be appended to error dialog boxes.

Error=https://www.secmaker.com/help/

Default value is none; no extra link in error dialog boxes.

This entry will be shown in taskbar menu and appended to error dialog boxes if Error link is not specified.

Help=http://www.secmaker.com/help/

Default value is none; no help link in taskbar menu.

This entry will be used by administration utility for default mail address when initiating any send mail. For example when sending a trace file from administration utility.

Mail=mailto:netid@secmaker.com

Default value is none; no default mail address.

This entry will be shown in the taskbar menu.

Support=https://www.secmaker.com/support/

Default value is none; no support link in taskbar menu.

This entry can be used to enable/disable writing of secondary certificates. When it is disabled, writing of the same certificate object will result in the existing certificate being overwritten. The normal behavior for smart card minidriver is not to support secondary certificates, meaning there is no support for multiple certificates using the same key.

Default value is 0; secondary certificates are not allowed.

This entry can be used to enable/disable writing of certificate/container information to a cache file. This cache is used by Credential Provider when used in pass-through mode. Microsoft has some limitations with multiple access, so this is used to avoid extra access from Net iD Enterprise Credential Provider towards minidriver when used with Microsoft Provider.

Default value is 1, certificate information is written.

This entry is used to tell whether certificate compression is supported internally or not.

Default value is 1; certificate compression is supported.

This entry is used to tell whether certificate mapping file content should be checked before writing. When checked the mapping file will only be written when different from the auto-generated content.

Default value is 0; certificate mapping file always written.

This entry will enable/disable clear of user PIN cache by the internal certificate propagation service.

Default value is 2; will clear user PIN cache for all users.

This entry specifies a list of applications which will not be able to use the minidriver, separated with ;.

This entry enables/disables Microsoft smart card file cache.

Default value is 0; smart card file cache is active.

This entry enables/disables Microsoft smart card PIN cache.

Default value is 0; smart card PIN cache is active.

This entry is used to register a friendly name for the certificate in CryptoAPI user certificate store. The following wild cards may be used:

Label is the certificate label stored with the certificate object, issuer and subject are any of the object identifiers available in the subject or issuer field from the certificate. Any combination of static text and wild cards above may be used.

Default value is "%subject.2.5.4.3% (%issuer.2.5.4.3%)".

This entry enables/disables the use of guid from certificate mapping file as key id.

Default value is 0; key id is generated from guid.

This entry enables/disables internal use of the card cache file \cardcf. The card cache file will be automatically generated from card update counter when disabled.

Default value is 0; Microsoft card cache file will be used.

This entry enables/disables internal use of the certificate mapping file \mscp\cmapfile. The mapping file content will be automatically generated when disabled.

Default value is 0; Microsoft certificate mapping file will be used.

This entry specifies a list of applications which will not be able to logout, all logout calls will be ignored.

Default value is none; all applications will be able to logout.

This entry specifies the mode for key id generation, either let the smart card decide the key id or generate a key id based on the GuidKeyId parameter.

Default value is 0.

This entry specifies the maximum size of the RSA keys.

Default value is 2048; maximum RSA key size of 2048 bits.

This entry specifies the minimum size of the RSA keys.

Default value is 1024; minimum RSA key size of 1024 bits.

This entry specifies whether internal certificate propagation to CryptoAPI store should be used or not.

Default value is 0; Microsoft certificate propagation should be used to move certificates.

This entry specifies whether pkcs#11 keys without connected certificates should be mapped as minidriver keys.

Default value is 0; load pkcs#11 keys.

This entry specifies whether move certificates should overwrite possible existing certificates for internal certificate propagation. This will have affect when there are several different certificate propagation services enabled or when the same smart card is supported by several vendors.

Default value is 0; will not overwrite.

This entry specifies a list of applications which will generate an event to register the certificates for CryptoAPI to Net iD CSP instead of to Minidriver.

IgnoreLogout=lsass.exe;logonui.exe

Default value is none; no applications will generate an event to register the certificates.

This entry enables/disables Microsoft PIN cache. Will only affect PIN1, secondary PIN will always have PIN cache disabled.

Default value is 0; Microsoft PIN cache is active.

This entry specifies the timeout value for Microsoft pin cache.

Default value is 0; Microsoft pin cache is active as long as Microsoft think is suitable.

This entry specifies whether the minidriver should report all smart cards as read-only, i.e. not possible to update in any way.

Default value is 0; smart cards are updateable.

This entry specifies whether a default certificate should be marked as default for minidriver certificate mapping file.

Default value is 0; default certificate is not marked.

This entry specifies how the certificates should be sorted when a default certificate is used.

Default value is 0; sorting inherited from pkcs#11.

This entry specifies whether the supplied key padding mechanism or the internal implementation should be used. The padding mechanism is needed to format data to be signed or data to be encrypted before the key operation.

Default value is 0; internal padding is used.

This entry specifies whether caller is allowed to update the card update counter. When not allowed all updates will be ignored and the update is handled internally.

Default value is 0; internal update counter is used.

This entry specifies which version of the minidriver specification that should be supported. Currently versions 4 to 6 are supported.

Default value is all versions.

The minidriver file system will be stored in a virtual file system. This entry specifies the block size for the virtual file system, to avoid unnecessary reallocation when objects are created on smart cards which separate data from information about the data.

Default value is 0; a suitable value is chosen for the smart card type.

This entry specifies a list of applications, separated with ;, that may be closed if they open a SSL session.

Default value is none; no applications will be handled.

This entry specifies whether the user should be asked before trying to close an application.

Default value is 1; ask user before close of application.

This entry specifies whether this feature should be active.

Default value is 0; net control is inactive.

This entry specifies a list of logon applications, separated with ;, that may be closed if they open a TLS session.

Default value is none; no logon applications will be handled.

This entry is used to always require login for SSL/TLS. When enabled an automatic logout will be done each time an SSL/TLS connections is established.

Default value is 0; no automatic logout when SSL/TLS connection is established.

See Pkcs11 — LoginTimeout for another way to handle automatic logout.

This entry specifies whether new slots should be detected each time the application asks for the current slot list. A slot is either a smart card reader or a soft token, so this parameter may be used to detect arrival of new smart card readers.

Default value is 0; no detect of new slots.

See SmartCardReader — Detect for another way to detect arrival of smart card readers.

Recommended value for Detect is 1, when used in combination with this parameter.

This entry specifies a list of applications, separated with ;, which will not be able to use duplicate certificates. Duplicates are certificates with identical issuer and subject field and same public key. Only the newest certificate will be available for the application.

DisableDuplicate=Firefox;Mozilla

Default value is none; all applications will see duplicate certificates.

This entry specifies a list of applications, separated with ;, which will not be able to use certificates with non-repudiation key usage.

DisableNonRep=Firefox;Mozilla

Default value is none; all applications will be able to use non-repudiation certificates.

This entry enables/disables the use of external mutex to protect multi-threaded sessions.

Default value is 0; always use internal mutex.

This entry enables generation of a certificate label according to a specific format instead of using the default label from the token. The following wild cards may be used:

Label is the certificate label stored with a certificate object, issuer and subject is any of the object identifiers available in the subject or issuer fields from the certificate. Any combination of static texts and wild cards above may be used.

Default value is none; the stored certificate label is used.

This entry is used to set a timeout for the login. When enabled an automatic logout will happen after the number of specified seconds.

Default value is 0; no automatic logout.

See AlwaysLoginForSSL above for another way to handle automatic logout.

This entry specifies a list of applications that should be considered as logon applications. This means that PIN cache always is ignored and that PIN always is verified even when being the same value as in PIN cache.

Default value is lsass.exe;winlogon.exe.

This entry is used to control the behavior when the last session towards a token is closed. Specifies a list of applications that will generate a logout, separated with ;.

Default value is empty; no application will generate an automatic logout.

This entry is used to always create a number of empty slots which always will be available even when no smart card readers and/or soft tokens are present.

Default value is 0; no extra slots.

This entry is used to specify an OpenSSL library that should be loaded to generate random and/or key pairs. Typical names for different platforms:

Default value is none; internal algorithms will be used for generating random and/or key pairs.

This entry sets the global maximum number of digits policy. Specify the maximum number of required digits.

Default value is 0; no minimum number of digits required.

This entry set the global minimum number of digits policy. Specify the minimum number of required digits.

Default value is 0; no minimum number of digits required.

This entry is used to specify a location to report failed logon attempts on Windows platform. May be configured to report to either Windows EventViewer or to an ODBC source. Reporting to an ODBC source will require the table to be correctly formatted, more information is available from your support contact.

Default value is none; no error reporting.

This entry is used to enable/disable the support of random generation.

Default value is 0; random generation available.

This entry is used to enable/disable reset of internal temporary files at initialize.

Default value is 0; reset at initialize disabled.

This entry is used to enable/disable concurrent searches in different threads using the same session.

Default value is 0; concurrent searches are not allowed in different threads using the same session.

This entry specifies a list of applications, separated with ;, which will set a write protected soft token.

This entry is used to enable/disable the use of a single password/PIN for smart cards. The parameter has no affect for soft tokens, since they always have a single password/PIN.

Default value is 0; all available PINs are usable.

This entry is used to enable/disable calculation of execute time. The time is the number of milliseconds spent within the pkcs#11 library. This will generate an extra trace entry with the number of milliseconds within library and also the number of milliseconds spent on card during this time. Used to measure the performance.

Default value is 0; execute time not written.

This entry is used to enable/disable update of slot list when library is called for active event list (C_WaitForSlotEvent). Default behavior will use [SmartCardReader[>Poll parameter to detect smart card insert/remove and [SmartCardReader]>Detect parameter to detect smart card reader insert/remove.

Default value is 0.

This entry is used to enable/disable verification of cryptographic algorithms during initialize.

Default value is 0; algorithms not verified.

This entry is used to enable/disable wait for Windows smart cards service to start before initialize continues.

Default value is 0; no wait for smart card service.

This entry may be used to update default access condition requirement for properties that are read from plugin.

This entry may be used to update default access condition requirements and value checks for properties that are sent to plugin.

This entry may be used to update default access condition requirements for properties that are enumerated from plugin.

This entry may be used to update default access condition requirements for invoke of plugin functions, see Developer’s Guide for more information.

This entry may be used to log blocked plugin calls.

This entry contains a list of application names with access mode for use with the plugin, separated with ;. Specify with name and access mode value. Currently three modes are available:

Either specify name of file stored in installation folder, or specify full path to application (may use environment variables).

This entry is used to specify a list of applications, separated with ;, which will not be allowed to use the ActiveX plugin.

Default value is none; all applications will be able to use the plugin.

Use this parameter to enable/disable installation of web browser plugins.

Default value is 1; web browser plugins are available.

This entry is used to enable/disable the start of certificate service when loaded.

Default value is 0; will not start service.

This entry is used to set the IP address of the SCS but must always be set to localhost (127.0.0.1) at the moment.

Will be used in the future if there will be any extensions for IP v6.

This entry is used to set the port for the SCS. The SCS specifications defines that the first port available will be used so the default settings should not be changed.

Will be used in the future if there will be any extensions for IP v6.

Default values is 8088;23123;53951; values should not be changed.

This entry is used to define the protocols that are allowed for the use of SCS. Valid protocols are http or/and https.

Default value is none; no protocols allowed.

This entry is used to define the maximum size of a signature in bytes. The SCS specifications recommends to use 2 MB as the maximum size but it is possible to set the values in the interval of 4 kB to 16 MB.

Default value is 0x02000000; maximum size of 2MB.

This entry is used to enable the SCS.

This entry is used to disable the SCS.

This entry is used to enable/disable the support for single-sign-on for CryptoAPI CSP.

Default value is 0; single-sign-on disabled.

This entry is used to specify a list of applications, separated with ;, which always will have single-sign-on disabled.

Default value is none; all applications will use single-sign-on when available.

This entry is used to enable/disable the support for single-sign-on for PKCS#11.

Default value is 0; single-sign-on disabled.

This entry is used to specify a list of applications, separated with ;, which may act as single-sign-on server.

Server=winlogon.exe;lsass.exe

Default value is none; no application may act as single-sign-on server.

This entry is used to specify a list of applications, separated with ;, which may start single-sign-on server.

StartServer=winlogon.exe;lsass.exe;logonui.exe

Default value is none; no application may start single-sign-on server.

This entry is used to enable/disable the support for single-sign-on via a cache server. The normal single-sign-on solution will direct CSP/PKCS11 calls to a single process which will have exclusive access to the smart card.

Default value is 0; normal single-sign-on is used.

This entry specifies whether the single-sign-on server should be running as a service or as a background process.

Default value is 0; run as background service.

This entry specifies whether the single-sign-on server should search for username/password stored on tokens and use the information to automatically fill the username/password edit boxes.

Default value is 0; no search for stored username/password.

The search will check the private box area for object with the following format:

This entry specifies whether execution time on smart card should be written to trace.

Default value is 1; will calculate and write execution time.

Command chaining will be activated when 256 or more bytes are sent towards smart card. This parameter may be used to set a lower number to activate command chaining earlier.

Default value is 0; command chaining is activated when needed.

This entry enables/disables creation of the update counter as soon as logged in towards a smart card.

Default value is 0; will create update counter when creating any other object.

All smart card profiles have a detection mechanism built into the specification, but this parameter may be used to detect a card profile not using the standard detection mechanism. Currently, only "PKCS#15" and "ISO7816-15" are supported.

Default value is none; profiles are found according to specifications.

The card profile is detected after card type detection. Some smart cards have multiple profiles on the same smart card which should be loaded in parallel. This parameter specifies the number of maximum number of profiles that may be detected.

Default value is 4; the same value as the maximum number of PINs (currently 4).

This entry is used to disable writing card cache file to disk. SSO service will be used for card cache if available.

Default value is 0; card cache will be written to disk.

This entry is used to set sorting mode for the certificates on a smart card. Some applications will use the first returned certificate as the default certificate, so it can be considered as setting the default certificate.

Default value is 2; sorting based on seconds.

This entry is used to enable/disable PIN expire policy. The PIN may be configured to require a change after X number of days.

Default value is 0; no PIN expire policy.

This entry is used to enable/disable password history checking. When enabled the old password will be stored as a private object and compared with a new password.

Default value is 0; no password history checking.

This entry is used for maximum PIN length policy.

Default value is 0; smart card profile will specify the PIN policy.

This entry is used for minimum PIN length policy.

Default value is 0; smart card profile will specify the PIN policy.

This entry is used for password policy, 0xaAbBcCdD:

Default value is 0; no special PIN policy.

This entry is used for PIN type policy, the requirement are below:

Default value is 0; smart card profile will specify the PIN policy.

This entry is used to specify a list of names, separated with ;, containing smart card types that should be considered temporary smart cards. The parameter only has any meaning when used with a LRA component, see LRA documentation for more information.

This entry is used to specify a number of days for certificate validity to be considered as a temporary smart card. The parameter only has any meaning when used with a LRA component, see LRA documentation for more information.

This entry specifies the use of internal update counter. The update counter is needed to detect updates of the smart cards, so it should usually always be activated

Default value is 1; will use internal update counter.

This entry enables/disables validation of the update counter when external update counter is used.

Default value is 0; will not validate update counter when using external update counter.

This entry specifies the full path to the Zlib compress library.

Default value is depending on the operating system used; will try to load by standard Zlib name.

This entry specifies the behavior for compressing. When reading uncompressing will always be done if the file is compressed, but files may be stored with or without compressing when written.

Default value is 0; will compress when writing.

This entry will enable/disable complete erasure of smart cards before initialization.

Default value is 0; smart card not erased.

This entry specifies the number of key pairs that should be generated during initialization.

Default value is 0; no key pairs are generated.

This entry specifies a custom parameter for a specific smart card.

Default value is none; no custom parameter.

This entry will enable/disable simple erasure of smart card objects; delete access below will be overridden and set to ALW.

Default value is 0; simple erase disabled.

The following entries in the section specify the files and/or directories that should be created.

Format:

Value <name> is the full name of the object; dependent on the smart card used, but usually a directory starting with EF(MF):

Value <type> is the type of object; dependent on the smart card used, but usually: DF (directory), EF (file), SEC (PIN):

Value <size> is a number telling the size of the object; dependent on the smart card used, may be a size of a file or number of objects that may be stored in the directory. Smart card may support the string value all and/or auto to take all remaining area respective try to guess the file size.

Value <access> is the access condition elements; dependent on the smart card used and type of object, but always four parts separated with :; <delete>, <read>, <write> and <execute>. Each element may have one of the following values: ALW (=always), NEV (=never), SO (admin PIN), PIN1, PIN2, PIN3 or PIN4.

Value <content> is the real object content in hexadecimal form; dependent on the smart card used and type of object.

This entry enables/disables the possibility to remove smart card readers as PKCS#11 slots at runtime when reader is removed.

Default value is 0; reader will not be removed.

This entry contains a list of smart card reader names that are acceptable, separated with ;.

Default value is none; all reader names are accepted.

Use [SmartCardReader]>Denied parameter to specify a list of reader names that are denied.

This entry contains a full path to a directory which will be used to store the smart card cache.

Default value is none; will use the standard temporary directory, location depending on operating system and version.

This entry specifies the number of minutes the smart card cache is valid for user environment.

CacheValidity=10080

Default value is 10080; one week, 7*24*60=10080 minutes.

This entry tells the status of smart card cache when no update counter is available.

Default value is 0; cache is inactive when no update counter is available.

This entry enables/disables the check for information from the smart card reader, for example driver version or PIN pad information.

Default value is 0; will not check for information.

This entry enables/disables the check for PIN pad from the smart card reader, will require that checkInformation above is enabled.

Default value is 0; will not check for PIN pad.

This entry contains a list of smart card reader names that are not acceptable, separated with ;.

Default value is none, all reader names are accepted.

Use [SmartCardReader]>Accepted parameter to specify a list of reader names that are accepted.

This entry specifies the number of seconds from initialize that the library should search for smart card readers. This allows smart card readers to be inserted after the library has been initialized.

Default value is 60; will search in 60 seconds for smart card readers.

This entry controls the behavior when smart card is opened and session is logged on.

Default value is 0; will not lock reader when logged on.

This entry specifies the number of milliseconds the PIN should be kept after card removal. This can be used to avoid clear of PIN cache when a smart card reader generates strange remove/insert events, but should not be used in normal situations.

Default value is 0; PIN cache is cleared when the smart card is removed.

This entry specifies the number of seconds to keep the card locked after usage. This may be used to increase performance, since lock/release card may require some substantial time.

Default value is 0; no delay when releasing card.

This entry specifies the number of seconds to keep trying to lock the card when it is in use by another application.

Default value is 30; will try locking the card for 30 seconds.

This entry configures the maximum number of bytes that may be transmitted for each smart card call. Minimum value is 64 bytes and maximum value is 255 bytes.

MaxTransfer=255

Default value is 255; 255 bytes.

This entry specifies the mode to connect with towards the smart card, either exclusive or shared mode. Exclusive mode requires the application to work alone with the smart card. Shared mode allows simultaneous connections and will require transaction handling to handle atomic operations.

Default value is 1; shared mode used.

This entry specifies the number of milliseconds between polling for card presence.

Poll=333

Default value is 333; 333 milliseconds.

This entry specifies the protocol to use when communicating with the smart card.

Default value is -1; protocol negotiated with smart card.

This entry specifies the behavior when the reader connection fails for some reason.

Default value is 0; do nothing.

This entry specifies the behavior when connecting to the smart card reader. Either uses one connection for all purposes or two connections, one connection for smart card status and one connection for transmitting smart card commands.

Default value is 0; two connections.

This entry specifies the scope for the smart card reader connection: user, terminal, system or global. The real meaning of scope is depending on smart card reader type, currently only used by PC/SC. See PC/SC documentation for more information.

Default value is 0 for user processes and 2 for system processes.

This entry specifies the number of minutes the smart card cache is valid for system environment.

SystemCacheValidity =10080

Default value is 10080; one week, 7*24*60=10080 minutes.

This entry specifies whether the CTAPI smart card reader support should be available.

Default value is 1; CTAPI smart card reader support is available.

All CTAPI drivers are delivered as a dynamic library and will be loaded by a numbered list starting from 1. The format for each entry is: "<ctn>,<pn>,<library>":

This entry is used to include writing of each PC/SC call towards trace.

Default value is 0; PC/SC calls are not written.

This entry specifies whether the PC/SC smart card reader support should be available.

Default value is 1; PC/SC smart card reader support is available.

This entry specifies the PC/SC library that should be loaded. Default values:

This entry changes the behavior for smart card present check.

Normally smart card presence is checked by asking the smart card readers quite often by polling, the poll time is controlled by [SmartCardReader]>Poll entry.

Using this parameter will change to a call method which will ask for state and not return until something has changed.

Default value is 0; normal polling is used.

This entry is used to control the unloading of the PC/SC library.

Default value is 1; library unloaded when not used.

This entry is used to add a global critical section for all PC/SC calls. When it is enabled only one thread will access PC/SC at each time.

Default value is 0; critical sections should be handled by PC/SC.

This entry is used to add events handling to soft tokens. Soft tokens may be removed when removed from other processes and will also generate an insert event when the soft token is updated, to allow applications to detect updates.

Default value is 0; no special event handling.

This entry is used to specify the file type used by soft tokens. The internal soft token format ".tkn" is the only supported value for Windows/Linux. macOS may use the internal format or Apple ".keychain".

Default value is none; internal soft token format.

This entry is used to enable/disable password expire policy. The password may be configured to require a change after X number of days.

Default value is 0; no password expire policy.

This entry is used to specify how password failures will be handled for soft tokens, i.e. if a user gives the wrong password when trying to use the soft token.

PinFailure=0xAABBCCDD

Default value is none; no handling of password failures for soft tokens.

If no blocking period is configured, that is, CC is set to 00, a restart of the application is necessary to be able make new tries. If a blocking period is configured a restart will make no difference since it is stored in the object, that is, you will have to wait until the blocking period ends to get DD new tries.

This entry is used to enable/disable password history checking. When enabled the old password will be stored as a private object and compared with a new password.

Default value is 0; no password history checking.

This entry is used for maximum password length policy.

Default value is 64; maximum 64 bytes password.

This entry is used for minimum password length policy.

Default value is 2; minimum 2 bytes password.

This entry is used for the password policy, 0xaAbBcCdD:

Default value is 0; no password policy.

This entry is used for password type policy, the requirements are below:

Default value is 0; all characters allowed and case sensitive.

A list of commands executed when a smart card is inserted.

A list of commands executed when a smart card is removed.

Use component name as entry instead of File to enable trace for a specific component:

Admin= C:\Temp\iid.txt

CredentialProvider=C:\Temp\iid.txt

CSP= C:\Temp\iid.txt

Directory=C:\Temp\iid.txt

MiniDriver=C:\Temp\iid.txt

Pkcs11=C:\Temp\iid.txt

Plugin=C:\Temp\iid.txt

SSO=C:\Temp\iid.txt

Watch=C:\Temp\iid.txt

Web=C:\Temp\iid.txt

Use File entry to specify trace for all components to same file without Net iD Trace service:

File=C:\Temp\iid.txt

Use Server entry to specify trace for all components to same file with Net iD Trace service:

File=server

Server=C:\Temp\iid.txt

This entry specifies if local time should be used when creating trace file.

Default value is 1; local time will be used.

There are several ways to open different files, but to avoid misuse all file types that may be opened should be registered, separated with ;.

Default value is .txt;.html;.htm;.cer;.crt;http;https.

There are several ways for the watch component to open different files, but to avoid misuse all file types that may be opened should be registered, separated with ;.

Default value is none.

This entry specifies whether the Watch component should be running as a Windows service or a background process.

Default value is 0; run as background process. This parameter is for Windows only and will be ignored by other operating systems.

A list of commands executed when a smart card is inserted.

A list of commands executed when a smart card is removed.

A list of commands executed when smart card is inserted for the logged on user.

A list of commands executed when smart card is removed for the logged on user.