0

Please confirm that I understand these ActivIdentity concepts for a CAC correctly.

Per Session: User runs IE and hits an SSL webpage that requires CAC authentication. He authenticates and ... he's in. If the user opens up another tab (another process), and tries to access that same website, he'll be authenticated already. As a result, he won't need to re-authenticate.

Per Process: User opens first webpage via successful CAC PIN authentication (same as above). Now, when he opens up a new tab to access the SSL website, he'll need to re-authenticate since he's accessing a new process.

Kevin Meredith
  • 41,036
  • 63
  • 209
  • 384

1 Answers1

0

I assume you are referring to the ActivClient PIN caching settings?

Per session refers to entire Windows login session. Per process refers to each Windows process that is launched.

So, if PIN caching is set Per Session then, once you have entered the PIN for the card, it will be cached for 15 minutes (default) for any application which requests a card operation in that Windows session. Therefore the user will not be prompted for the PIN again for ANY application until the the PIN cache times out.

In Per Process mode the PIN is only cached for the process which requests it. For example; the users opens IE and logs into a CAC application using a PIN, the PIN is then cached for that particular IEXPLORE.EXE process for 15 minutes (default). If the user then opens Outlook, within the 15 minute window, and tries to sign an email using is card then he will have to enter the PIN as it is not cached for OUTLOOK.EXE. As each IE tab spawns a new process the principal should be the same.

The following is taken from the ActivClient admin guide:

ActivClient PIN cache can be configured to apply either per session (this refers to the Windows session) or per process (this refers to a Windows process).

Per session mode (the default configuration) allows all the processes in the user’s Windows session to share the same PIN cache (that is, user authentication is required once for the entire session whatever the applications used during the session).

In per process mode, the PIN cache is separate for each Windows process (that is, users need to enter their PIN at least once per process that will use the card).

In both modes, you can further customize the PIN cache behavior for specific applications by using the Include list, Exclude list and Open card list

UK Matt
  • 1