User's Manual

Declaration of the WebIdentity Server ActiveX object by the HTML OBJECT tag; the OBJECT

tag enables

inserting in the HTML document the ActiveX univocally identified by means of the class id, which for the

client ActiveX is 878A0D61-48D2-11D3-A75D-00A0245382DE. The attribute identifies the object univocally

inside the document by means of a label thus enabling interaction. The CODEBASE attribute is necessary in

case ActiveX is not registered on the current machine. Such an attribute specifies the location (URL) from

which it is downloaded. In addition to the URL it is possible to enter the control version ( #version= ) so

that it can be downloaded, if more recent than the installed version.

Javascript InitToken function used for initializing the token.

Initialization of the server object with the Label for token identification; the Label entry is a server ActiveX

variable inside the HTML document.

Initialization of the server object with the Server Secret; the Password entry is a server ActiveX variable

inside the HTML document.

Call to ActiveX Server InitDongle method for the actual initialization of the hardware token; the parameter

that is transmitted is the User Data entered in the HTML form; the User-Id that is returned by the

InitDongle is assigned to the TxtUserId variable of the HTML form for display.

The example illustrated below the association of the (token) User-Id with the user profile has been left out, as

previously explained at paragraph Errore. L'origine riferimento non è stata trovata.. However the user-token

association is also important as it enables identifying the user following authentication.

6.3 Session operation

WebIdentity requires the use of certain server side variables such as, for instance, the Label, the Random Session String

etc. For an easy management of such variables it is possible to use the session feature, which is available in all

application servers nowadays. In addition to the server side variables it is possible to store also the user status, so as to

be able to manage the authentication phase just on one application point or in specific areas of the service itself.

However it is possible to implement the authentication at each step (page) if this turns out to be necessary. Using the

session is a very useful method for managing the persistence of data between one page and another but it requires a

mechanism which enables interrupting the session on request or after a certain time lapse; it is therefore advisable to

insert – even in each page – the possibility to run the logoff manually on the user’s request and to configure the session

timeout suitably inside the application server or the web server (e.g. IIS) avoiding too small values, which hinder the

service usability, as well as too big values which might jeopardize security in some cases.

At present supported only by Internet Explorer 4.0+. For Netscape it is necessary to use a Javascript for installing the

relevant Plug-In.

<p>Label</p>

<input type="button" language="javascript" onclick="return InitToken()"

value="Init Token"><br>

</body></html>