DelphiXE8 and WSDL, disable authentication via Smart Card Reader

[carmeloconny]

I'm sorry* if I write in translated English.
With Delphi XE8 I imported a SOAP WSDL and use the HTTPRIO component For use authentication:

Delphi-Quellcode:

procedure HTTPRIO1HTTPWebNode1BeforePost(const HTTPReqResp: THTTPReqResp;
  Data: Pointer);
var
 auth: String;
 FUserName, FPassword : string;
begin
 FUserName:=UtenteTS;
 FPassword:=PassTS;
 auth := 'Authorization: Basic ' + TNetEncoding.Base64.Encode(FUserName + ':' + FPassword);
 HttpAddRequestHeaders(Data, PChar(auth), Length(auth), HTTP_ADDREQ_FLAG_ADD);
end;

Works well.

The problem is: when a Smart Card Reader with a digital signature card is inserted in the PC, during authentication it communicates with the smart card, opening a PIN request window.
image:
https://i.stack.imgur.com/puJ7E.jpg

I don't want this, i want to prioritize authentication through HTTPRIO1HTTPWebNode1BeforePost !

Note:

Run debug, HTTPRIO1HTTPWebNode1BeforePost, it is processed and then communication with the smart card is started. How can I disable Smart Card Reader reading?

The card with the digital signature I need connected to the PC because my program has to digitally sign documents.

[Sinspin]

Hello and welcome in the DP!

If i understand you right, the smart card reader is separate and have nothing to do with the web service where you communicate with via WSDL.
But, if you try to start the authentication process for the web service then is also the smart card reader reacting?
Where is the web service running? On the same PC?
What kind of web service is it?

[carmeloconny]

Zitat von Sinspin:

Hello and welcome in the DP!

If i understand you right, the smart card reader is separate and have nothing to do with the web service where you communicate with via WSDL.
But, if you try to start the authentication process for the web service then is also the smart card reader reacting?
Where is the web service running? On the same PC?
What kind of web service is it?

thank you for answering. (excuse my bad english)
WSDL is a state ministerial service for the Italian national health service.
The WS requires authentication: Authentication base = 'User : Password'

When the certified card is not inserted, everything works fine.
When the Card Certificate is inserted in the Smart card reader of the PC,
during the authentication of the WS a window opens and wants the PIN of the certified card, which does not center with the authentication of the WS, this thing slows down the communication and a waste of time.

with the procedure I wrote before, using HTTPrio component works fine.
When the system has a smart card with a certificate, HTTPrio, who uses WinInet.dll (windows), starts the card request window of the card. Which I don't want!
The certificate in the authentication header must be only: User and Password.
I tried to close:
CertCloseStore (hMemoryStore, CERT_CLOSE_STORE_FORCE_FLAG)
I tried:
InternetSetOption(Data, INTERNET_OPTION_SECURITY_FLAGS, @aFlags, aFlagsSize)
Without success.

this step in the SOAPtrans.pas file is repeated twice. on the second step the card reading starts.
first step: RetVal = ERROR_INTERNET_FORCE_RETRY;
second step: RetVal = ERROR_SUCCESS;

Delphi-Quellcode:

 { line 1151 of soap.SOAPHTTPtrans.pas  Posting Data Event }
      if Assigned(FOnPostingData) then
        FOnPostingData(DatStr.Size, BuffSize);

      RetVal := ERROR_SUCCESS;
{$IFDEF UNICODE}
      HttpSendRequest(Request, nil, 0,
                      DatStr.Bytes, DatStr.Size);
{$ELSE}
      HttpSendRequest(Request, nil, 0,
                      @DatStr.DataString[1],
                      Length(DatStr.DataString));
{$ENDIF}
      RetVal := HandleWinInetError(GetLastError, Request, True);

      case RetVal of
        ERROR_SUCCESS: break;
        ERROR_CANCELLED: System.SysUtils.Abort;
        ERROR_INTERNET_FORCE_RETRY: {Retry the operation};
      end;

[carmeloconny]

I have verified that this problem occurs with all those who use HTTPrio and authentication "Authentication base = 'User: Password". It's not just my situation.
Delphi + HTTPRio + Authentication Base + SmartCard or KeyUSB with certificate = PIN request message.
The WS accepts basic Authentication not certified by smartcard

[Sinspin]

As per my understanding have it to do with signing/certification of the internet connection.
There is a property "InvokeOptions" in the SOAP component. Type is SOAPInvokeOptions in the unit SOAPHTTPTrans. Maybe it is a solution to change the InvokeOptions for your requests.

OT: your english is not bad, no need to worry about

[HolgerX]

Hmm..

Obviously, Windows handles the smart card on its own and ignores alternative logins.

Maybe the group policies help here:
https://docs.microsoft.com/en-us/win...istry-settings

Or deactivating the SmartCard:
https://stackoverflow.com/questions/...ws-10/38474107

[Sinspin]

As i understood it, the smart card is needed for an part of the application. So its not possible to deactivate it over all.
Group policy would only help at the local PC but i don't think the programm is made for private use.

[carmeloconny]

Zitat von Sinspin:

As per my understanding have it to do with signing/certification of the internet connection.
There is a property "InvokeOptions" in the SOAP component. Type is SOAPInvokeOptions in the unit SOAPHTTPTrans. Maybe it is a solution to change the InvokeOptions for your requests.

OT: your english is not bad, no need to worry about

I setting "InvokeOptions" [soIgnoreInvalidCert, soPickFirstClientCertificate]


Normally, with these settings it works, if I change I get an error.
I tried the various combinations but without success.

[carmeloconny]

Zitat von HolgerX:

Hmm..

Obviously, Windows handles the smart card on its own and ignores alternative logins.

Maybe the group policies help here:
https://docs.microsoft.com/en-us/win...istry-settings

Or deactivating the SmartCard:
https://stackoverflow.com/questions/...ws-10/38474107

The card must be connected to the PC, because in another process of the program it is necessary to sign pdf file.

[Sinspin]

As workaround, would it be possible to ask the customer/user to remove the card as long not needed? Then should it work for now.
As reason can you mention that it is for savety to have the card only in the reader if the signing process is needed.

That gives you also more time to find a better solution. And you can still proceed with the programming.

Also, did you tried another component for sending the requests? For some not really Delphi compatible WSDL's used i another component. Its a bit more work to send the requests and analyse the response, but its stable working since years. Its called IP*Works / IP*Works SSL from NSoftware.
You can not really import the WSDL, but since its just pieces of XML data which is send to the server and you get another piece back it might work.