A login at Password Safe by means of certificates via token or smartcard is possible as well. A precondition for this is a public-key-infrastructure in your company as well as the licensing of the module PKI (only available in combination with the Password Safe Enterprise server.

First of all it has to be defined at the Password Safe Enterprise server how the users should be identified. You can find further information on this in the help of the PASSWORD SAFE Enterprise server under configuration -> server options -> certificate

Automatic allocation of the user certificate

If the accordant option has been activated at the Password Safe Enterprise server the domain as well as the user name from the certificate will be adjusted with the user name from Password Safe in order to allocate the accordant user. This option only works with users which have been taken over from the Active Directory and therefore have a domain affiliation.

Manual allocation of the user certificate

In order to allocate the certificate manually select file -> my profile -> user certificate at the Password Safe client.

PKI_match_Certificate

Here first of all the used provider has to be selected. If you should not know the provider please contact your system administrator. Afterwards you can you can select the accordant certificate. In this example the certificate has got the name of the user. According to the configuration of the PKI the certificates can also be called differently.

Login via the certificate authentication

For the login with token or smartcard please select the item certificate authentication in the login dialogue.

PKI_login_1

Afterwards the desired certificate can be selected under certificate.

PKI_login_2

At the first login via a certificate the key word or the PIN of the token or the smartcard has to be entered. For this a dialogue of the accordant provider appears.

Notice:

Especially in the test run it can happen that a user wants to log on at Password Safe that does not comply with the user logged in at the operating system. In this case consider the option user name must match with Windows logon name. You can find further information on this in the chapter manage users and groups.

If a user wants to log in using a token, the PIN for the token needs to be entered. If the Password Safe client is blocked and needs to be unblocked again, this PIN request does not appear. Therefore, the token should be configured in such a way that it is automatically blocked.