Pre-Release

The Pre-Release of PersoApp is based on the proprietary eID client by AGETO Service GmbH. It shall present the online identification from a user’s point of view and can be used for testing purposes. A demonstration and testing service will be provided that uses a public-key infrastructure (PKI). The proprietary eID client as well as the Open Source Software Library will be published to the Open Source Community as pure Java implementations. Please note that the proprietary eID client only works with this demo and test service.

The movie PersoApp-Pre-Release illustrates the mode of operation of this pre-release.

Features

The Open Source Software Library for integrating the online identification and the pre-release for testing purposes implement the following features:

New German national ID card online authentication for the owner with regard to a service provider, e.g. online shop, via an Internet connection
Presenting a service provider’s authorization certificate to an owner of a new German national ID card
Data reading and transmitting (including personal data stored on the new German national ID card) according to the specification of a service provider’s corresponding authorization certificate

The PersoApp Pre-Release is available at https://www.persoapp.de/wp-content/uploads/2013/06/AEC1.0_persoapp.jar and the following website http://eid.services.ageto.net/persoapp/.

Requirements

The Pre-Release is available as a JAR-File. It requires Java 1.6 or newer. The eID client has been tested with OpenJDK and Oracle’s corresponding version. The software runs on the following operating systems: Microsoft Windows (from Windows 2000, last tested version Windows 8), GNU/Linux and Mac OS X.

These systems also need PC/SC-support. Windows uses the smartcard-service `ScardSvr`. On GNU/Linux systems you need [pcscd](pcsclite.alioth.debian.org) and where necessary the `libpcsclite1` library.

To use the client, you need a card reader with the appropriate driver and an ID card. The card reader has to comply with TR-03119. GNU/Linux users need to install `libccid` where necessary. It is possible that the manufacturer has included the appropriate driver.

The ID card can be a testing-card or a real nPA with activated eID functionality. When using the testing-service be aware that only testing-cards are supported. The eID client communicates with an eID server. Thus, a working internet connection is a mandatory requirement.

Installing and Running the Pre-Release

The software does not need to be installed. The JAR file can be run straight away. In case the software is marked as executable; double-clicking it suffices to run it. In the command line the following command needs to be entered: `java -jar FILENAME`. `FILENAME` obviously is file name ending with `jar`.

After starting the software, there should be an icon in the taskbar. When you right-click it (Mac simple click) a menu should show up. The entries “About”, “PIN Management” and “Close” can be chosen to continue. By pressing “PIN Management” the activities of the eID client can be controlled.

As an alternative you can use the Java Webstart version at http://eid.services.ageto.net/persoapp/. The provided PersoApp test service is available for eID client demonstration and testing.

Proxy Settings

The default settings of system-proxies will be recognized and supported. Alternative proxies may be used by setting the JRE-Parameters `-Dhttps.proxyHost` and `-Dhttps.proxyPort`.

In the special case of (company-)proxies with mandatory user authentication the application tries to accomplish the login by using Kerberos. Keep in mind that new Windows versions and Service Packs (Windows 2000 SP4, Windows Server 2003, Windows XP since SP2 and every successor) provide only limited Kerberos single sign-on support by default. To re-enable the full support of Kerberos, you need to set the Registry key `allowtgtsessionkey` to `DWORD` at a value of ”1″.

In Windows XP SP2 the path to this registry entry is: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\`

In every later version of Windows the path is: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters`

If single sign-on over NTLMv2 is supported, the application chooses this as the next option. Afterwards every method comes up with the request for the user to enter username and password in the following order: Kerberos, Digest, NTLMv2, and Basic. The order is determined by widely spread assumptions on the security of each protocol and may change if needed. When using preset proxy-logindata please use the JRE-Parameters `-Dhttps.username` and `-Dhttps.password`.

Extension NoScript

Users of the Firefox extension NoScript should adjust the rules in `SYSTEM` as follows:

# Prevent Internet sites from requesting LAN resources.
Site http://127.0.0.1:24727/eID-Client Accept from SELF Sandbox GET
from ALL Deny

Site LOCAL
Accept from LOCAL
Deny