When using the smart card method, users enter the card's PIN for eDirectory login and are then prompted to enter a password for the workstation login. The Novell Client Single Sign-On feature can be used to automatically log in to the workstation after the eDirectory login. This is accomplished by securely storing the workstation credentials in eDirectory and using them for future logins.
During Single Sign-On, the Novell Client prompts for the workstation password the first time and stores it in eDirectory. On subsequent logins, the user is not prompted for the workstation password. This improves the user's login experience and is recommended for all advanced eDirectory authentication methods.
This option is applicable only for Windows XP. For other Windows Client platforms except Windows XP, refer to Setting Up Single Sign-On (SSO) in the Novell Client 2 SP2 for Windows Administration Guide.
Passive Mode Login is functionality added to the Novell Client 4.91 SP3. In passive mode, the Novell Client defers to the default MS GINA for the initial Windows login. After authentication to the workstation, the Novell Client attempts to authenticate to the Novell environment. The functionality was added to the Novell Client to allow environments that use Windows Active Directory* smart card authentication to function correctly. It allows the smart card to be used to authenticate to Active Directory and eDirectory.
In passive mode, the Windows username used for workstation authentication is also used for eDirectory authentication. In order to successfully authenticate, the username must exist in eDirectory, and the client's default location profile must be properly configured with the tree and context information.
To enable passive mode login, the following registry keys must be set:
Registry setting descriptions:
If PassiveModeNDSLoginRequired is set to True (1), the login experience requires a successful Novell authentication in order to succeed.
Login scripts are not processed by NWGINA in passive mode. The workaround is to run them after the GINA login. You can do this by placing a run entry in the registry, or you can create an entry in the startup file for Novell login:
In passive mode, the method's card monitoring functionality does not work when the card removal behavior is set to . This is because MSGINA (not NWGINA) is used for the workstation Lock/Unlock functionality.
NOTE:This option is applicable only for Windows XP.