110183 - Add improvement for face-to-face smart card cert enrollment.

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, enhancement, P5)

Description

[Stephane Saux]

When an organization wants to do a face-to-face smart card cert enrollment, it
would help if the browser could be configured to have a prefered token for cert
encrollment. This pref can be set by the admin setting up the machines in the
face-fo-face office.

When the pref is set, and a cert is requested, the keys are generated on the token.

Comment 1

[Stephane Saux]

Attachment: proposed patch

Comment 2

[Javier Delgadillo]

Comment on attachment 57867 [details] [diff] [review]
proposed patch

r=javi (I wonder how deployable this would be.	PK11_FindSlotByName checks the
name of the token if inserted.	So the pref will have to be set to the token
name and not the slot name.  Token name may be set by the user which would make
this pref useless.)

Comment 3

[Stephane Saux]

The idea here is that a workstation in a controlled space (say badge city) is
set up using some configuration tools (e.g., MCD) to set the preference to the
smart card reader installed on the workstation.

Users come and get a certs using a smart card on that workstation, and the cert
is issued to the smart card without the need for the SO checking over the user's
shoulder that the users chooses the hardware token rather than the software one.

cc Terry and Bob.  If it's not useful we don't want it, or maybe it needs more
thoughts.

Comment 4

[John Unruh]

Enhancement

Comment 5

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Mass change "Future" target milestone to "--" on bugs that now are assigned to
nobody.  Those targets reflected the prioritization of past PSM management.
Many of these should be marked invalid or wontfix, I think.

Comment 7

[timeless]

Comment on attachment 57867 [details] [diff] [review]
proposed patch

!NS_FAILED should be NS_SUCCEEDED ....