Namespace: Microsoft.Clm.Provision
Assembly: Microsoft.Clm.Provision (in microsoft.clm.provision.dll)
Usage
Visual Basic |
---|
Dim smartcardUuid As Guid Dim keyVersion As AdminKeyVersion Dim atr As String Dim cardId As Guid Dim returnValue As Byte() returnValue = ExecuteOperations.GetAdminKey(smartcardUuid, keyVersion, atr, cardId) |
Syntax
Visual Basic |
---|
Public Shared Function GetAdminKey ( _ smartcardUuid As Guid, _ keyVersion As AdminKeyVersion, _ atr As String, _ cardId As Guid _ ) As Byte() |
C# |
---|
public static byte[] GetAdminKey ( Guid smartcardUuid, AdminKeyVersion keyVersion, string atr, Guid cardId ) |
C++ |
---|
public: static array<unsigned char>^ GetAdminKey ( Guid smartcardUuid, AdminKeyVersion keyVersion, String^ atr, Guid cardId ) |
J# |
---|
public static byte[] GetAdminKey ( Guid smartcardUuid, AdminKeyVersion keyVersion, String atr, Guid cardId ) |
JScript |
---|
public static function GetAdminKey ( smartcardUuid : Guid, keyVersion : AdminKeyVersion, atr : String, cardId : Guid ) : byte[] |
Parameters
- smartcardUuid
-
A Guid object that identifies the smart card for the operation.
- keyVersion
-
An AdminKeyVersion value that specifies the version of the administrator key to retrieve.
- atr
-
A String object that contains the Answer To Reset (ATR) for the smart card.
- cardId
-
A Guid object that represents the smart card’s card identifier.
Return Value
A byte array that contains the raw administrator key for the smart card.
Remarks
This method returns the smart card’s administrator authentication key as defined in Base CSP. FIM CM tracks two version of the key: the initial version of the key and a diversified version, unique to each card.
In order for a call to this method to succeed, the caller of the method must be authorized to call the methods in the Sensitive API group. The Sensitive API group includes those methods where the caller has access to sensitive data. This includes the administrator PIN, the user PIN, the Base CSP administrator authentication key, and/or the Base CSP challenge response information.
To allow for a user, or a group of users, to be authorized to call the methods in the Sensitive API group, FIM CM must be configured as follows:
-
Open the
web.config
file that is associated with the FIM CM Web Virtual Directory (the default location of this file is%programfiles%\Microsoft Certificate Lifecycle Manager\web\web.config
). -
Locate the configuration section for the Sensitive API group, which resembles the following:
-
<add key="Clm.ProvisionApi.SensitiveApiGroup" value="" />
-
By default, FIM CM does not authorize any users to call the methods in the Sensitive API group.
-
Set the value to the name of a security group that contains the users who are to be authorized to call the methods in the Sensitive API group. The security group must be specified in the "domainname\groupname" format. For example:
-
<add key="Clm.ProvisionApi.SensitiveApiGroup" value="domain\SensitiveApiUserGroup" />
-
Save the
web.config
file.