API C/C++
HSM Dinamo
Loading...
Searching...
No entry found
Session

Detailed description

Client session management with HSM.

See HSM technical documentation.

Definitions and Macros

#define DN_INIT_PARAM_CONF_FAST_FAIL (128)
 

Functions

int AAP_API DInitialize (DWORD dwReserved)
 
int AAP_API DSetLBList (DWORD dwParam, void *pvList, DWORD dwListCount, DWORD dwReserved)
 
int AAP_API DGetLBList (DWORD dwParam, void *pvList, DWORD *pdwListCount, DWORD dwReserved)
 
int AAP_API DOpenSession (HSESSIONCTX *phSession, DWORD dwParam, BYTE *pbData, DWORD dwDataLen, DWORD dwFlags)
 
int AAP_API DSetSessionParam (HSESSIONCTX hSession, DWORD dwParam, BYTE *pbData, DWORD dwDataLen, DWORD dwFlags)
 
int AAP_API DGetSessionParam (HSESSIONCTX hSession, DWORD dwParam, BYTE *pbData, DWORD *pdwDataLen, DWORD dwFlags)
 
int AAP_API DGetSessionCacheCount (void)
 
int AAP_API DCloseSession (HSESSIONCTX *phSession, DWORD dwFlags)
 
int AAP_API DFinalize ()
 

Definitions and macros

DN_INIT_PARAM_CONF_FAST_FAIL

#define DN_INIT_PARAM_CONF_FAST_FAIL   (128)

#include <dinamo.h>

Configuration for fast failure.

Functions

◆ DInitialize()

int AAP_API DInitialize ( DWORD dwReserved)

#include <dinamo.h>

Initializes the client libraries Dinamo and makes them ready for use. It must be called before any other function.

Parameters
[in]dwReservedReserved for future use (must be 0).
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.
Notes
This function must be called only once per program instance that loads the libraries. The DFinalize() function must be called before the program terminates.
Examples
ckd_bchain.c, ckd_bchain_ed25519.c, connect_hsm.c, create_hash.c, crypt_sym.c, crypt_sym_gcm.c, crypt_sym_gcm_iv_auto.c, download_log.c, eft_calc_arpc.c, eft_merge_lmk_encrypt.c, eft_validate_cvv.c, export_import_tr31.c, gen_check_oath.c, gen_csr.c, gen_dh.c, gen_dukpt.c, gen_ecdh.c, gen_xecdh.c, get_hsm_info.c, get_key_info_bchain.c, get_pub_key_bchain.c, get_rt_logs.c, import_export.c, import_export_bchain.c, key_add_remove.c, key_attribute.c, list_keys.c, m_of_n.c, ocra_gen.c, pin_block_translate.c, pkcs7_sign.c, post_put_get_delete_pix.c, pqc_kem_encaps_decaps.c, pqc_kem_encaps_decaps_persistent.c, sc_change_pin.c, sc_copy_set.c, sc_create_svmk.c, sc_erase.c, sc_get_set_label.c, sc_inspect.c, sign_check_pix_jws.c, sign_verify.c, sign_verify_bchain.c, sign_verify_dict.c, sign_verify_dsa.c, sign_verify_eddsa.c, sign_verify_pix.c, sign_verify_pqc_ml_dsa.c, sign_verify_pqc_slh_dsa.c, sign_verify_xml.c, skeep_new_split_recover.c, skeep_probe_match.c, spb_activate_deactivate_cert.c, spb_enc_dec.c, spb_gen_key_csr.c, spb_get_cert.c, spb_import_p12.c, tokenization.c, user_add_remove.c, user_otp.c, and verify_pin_block.c.

◆ DSetLBList()

int AAP_API DSetLBList ( DWORD dwParam,
void * pvList,
DWORD dwListCount,
DWORD dwReserved )

#include <dinamo.h>

Sets the load balancing list. This configuration is applied in real-time.

Parameters
[in]dwParamSpecifies how the load balancing definition will be performed and, consequently, the data structure passed in the parameter pvList.
Value Meaning
DN_LB_LIST Type of pvList: LOAD_BALANCE_LIST. Defines one or more balance lists. All the fields in the structure must be filled in. Pass the array of lists. The number of items must be entered in dwListCount up to a maximum of DN_MAX_LB_SETS. The number of HSM_ADDR structures defined per list must be a maximum of DN_MAX_LB_HSM_COUNT.
[in]pvListPointer to the data or structures specified in dwParam.
[in]dwListCountNumber of lists passed in pvList.
[in]dwReservedReserved for future use (must be 0).
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.
Notes
When load balancing is defined, existing sessions will be physically closed as they terminate. New sessions will be created using the definitions from the new load balancing list. If the defined list is exactly the same as the currently active list, the load balancing list will not be updated.
This function will enable load balancing even if the load balancing variable is not enabled.

◆ DGetLBList()

int AAP_API DGetLBList ( DWORD dwParam,
void * pvList,
DWORD * pdwListCount,
DWORD dwReserved )

#include <dinamo.h>

Retrieves the currently active load balancing list.

Parameters
[in]dwParamSpecifies how load balancing recovery will be performed and, consequently, the data structure passed in the parameter. pvList.
Value Meaning
DN_LB_LIST Type of pvList: LOAD_BALANCE_LIST. Receives one or more balancing lists. The number of lists must be equal to or greater than the number of lists running. The number of items must be entered in dwListCount. The number of HSM_ADDR structures defined per list must be DN_MAX_LB_HSM_COUNT.
[in]pvListPointer to the data or structures specified in dwParam. Can be NULL to retrieve the number of lists configured.
[in,out]pdwListCountThe input should contain the number of lists passed into pvList. The output will contain the number of lists written to pvList. If pvList is NULL, this parameter will receive the number of lists expected.
[in]dwReservedReserved for future use (must be 0).
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.

DOpenSession()

int AAP_API DOpenSession ( HSESSIONCTX * phSession,
DWORD dwParam,
BYTE * pbData,
DWORD dwDataLen,
DWORD dwFlags )

#include <dinamo.h>

It establishes a session with Dinamo and returns a context to be used by all other functions.

Parameters
[out]phSessionPointer to the session context. After use, it must be released with the DCloseSession() function.
[in]dwParamSpecifies how session authentication will be performed and, consequently, the data structure passed in the parameter. pbData.
Value Meaning
SS_USER_PWD pbData Type: AUTH_PWD User and password authentication. All fields in the structure must be filled.
SS_USR_PWD_EX pbData Type: AUTH_PWD_EX
User and password authentication with optional OTP/Certificate. All fields in the structure must be filled; only the strong authentication fields are optional.
SS_ATOKEN pbData Type: AUTH_ATOKEN
Authentication using Access Tokens. All fields in the structure must be filled. See the DManageAToken() API for information on session token (Access Tokens) management.
SS_ANONYMOUS pbData Type: AUTH_PWD_EX or AUTH_PWD
No authentication. Only the szAddr and nPort fields of the structure must be filled. In the case of AUTH_PWD_EX, fill dwAuthType with SA_AUTH_NONE.
SS_HTTP Type of pbData: AUTH_HTTP
Authentication via HTTP at Dinamo Services. All fields in the structure must be filled in.
Not implemented.
SS_WIN_CREDENTIAL Type of pbData: AUTH_WIN_CREDENTIAL. All fields in the structure must be filled in.
[in]pbDataPointer to the data or structures specified in dwParam.
[in]dwDataLenSize of the data or structure specified in dwParam.
[in]dwFlagsChanges certain behaviors of the function; can be zero.
Value Meaning
ENCRYPTED_CONN Establishes an encrypted session (TLS v1.2). Data will be transmitted in clear text if this flag is not specified.
USER_INTERACTIVE Displays a dialog for the user to enter their identifier (ID) and password, or the path to the file containing their private key and digital certificate. Not yet supported.
LB_BYPASS Ignores load balancing configurations. Establishing a session at the HSM address indicated via pbData.
CACHE_BYPASS Ignores session cache configurations and opens this session without using the session cache.
DS_BYPASS Ignores session settings Dinamo Services.
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.
Notes
The context returned by this function must be used in all subsequent calls to the HSM and released via the DCloseSession() function after use. A TCP connection is established in this call and terminated when the context is released.
The session is established in clear text (without encryption) if the ENCRYPTED_CONN flag is not specified; otherwise, a TLS v1.2 tunnel is established between the two ends of the channel.
Dinamo natively features a load balancing and session caching system. If load balancing is active and you need to ensure that a session is opened at a specific IP address, use the LB_BYPASS flag. With LB_BYPASS, the DOpenSession function will ignore the load balancing address list. It is not possible to disable or bypass the device's session cache using this or any other API function.
If a user's password has expired, the function will return D_ERR_PWD_EXPIRED. In this scenario, a valid session handle will be returned, which can only be used for changing the authenticated user's password. If the password change is successful, the session will have other functions enabled; if the password change fails or any other operation is attempted, the session will be disconnected by the server.
Note
HSM sessions exhibit session-thread affinity, meaning a single session cannot be concurrently utilized by multiple threads.
Examples
ckd_bchain.c, ckd_bchain_ed25519.c, connect_hsm.c, create_hash.c, crypt_sym.c, crypt_sym_gcm.c, crypt_sym_gcm_iv_auto.c, download_log.c, eft_calc_arpc.c, eft_merge_lmk_encrypt.c, eft_validate_cvv.c, export_import_tr31.c, gen_check_oath.c, gen_csr.c, gen_dh.c, gen_dukpt.c, gen_ecdh.c, gen_xecdh.c, get_hsm_info.c, get_key_info_bchain.c, get_pub_key_bchain.c, get_rt_logs.c, import_export.c, import_export_bchain.c, key_add_remove.c, key_attribute.c, list_keys.c, m_of_n.c, ocra_gen.c, pin_block_translate.c, pkcs7_sign.c, post_put_get_delete_pix.c, pqc_kem_encaps_decaps.c, pqc_kem_encaps_decaps_persistent.c, sc_copy_set.c, sc_create_svmk.c, sign_check_pix_jws.c, sign_verify.c, sign_verify_bchain.c, sign_verify_dict.c, sign_verify_dsa.c, sign_verify_eddsa.c, sign_verify_pix.c, sign_verify_pqc_ml_dsa.c, sign_verify_pqc_slh_dsa.c, sign_verify_xml.c, skeep_new_split_recover.c, skeep_probe_match.c, spb_activate_deactivate_cert.c, spb_enc_dec.c, spb_gen_key_csr.c, spb_get_cert.c, spb_import_p12.c, tokenization.c, user_add_remove.c, user_otp.c, and verify_pin_block.c.

DSetSessionParam()

int AAP_API DSetSessionParam ( HSESSIONCTX hSession,
DWORD dwParam,
BYTE * pbData,
DWORD dwDataLen,
DWORD dwFlags )

#include <dinamo.h>

Modifies the session parameters.

Parameters
[in]hSessionContext acquired through the DOpenSession() function.
[in]dwParamSpecifies the session parameter to be configured and, consequently, the data structure passed in the parameter. pbData.
Value Meaning
SP_SESSION_TIMEOUT Type of pbData: DWORD
Global session timeout in milliseconds. This timeout value only applies to the client. .
Not yet supported.
SP_SEND_TIMEOUT Type of pbData: DWORD
Timeout in milliseconds for the send function of the network subsystem.
SP_RECV_TIMEOUT Type of pbData: DWORD
Timeout in milliseconds for the recv function of the network subsystem.
SP_SESSION_CACHE_TIMEOUT pbData type : DWORD
Timeout in seconds for the session to remain in the cache. The default is DN_SESSION_CACHE_DEFAULT_TIMEOUT. It can also be configured globally via the HSM_SESSION_CACHE_TIMEOUT environment variable before calling DInitialize().
[in]pbDataPointer to the data or structures specified in dwParam.
[in]dwDataLenSize of the data or structure specified in dwParam.
[in]dwFlagsReserved for future use (must be 0).
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.

DGetSessionParam()

int AAP_API DGetSessionParam ( HSESSIONCTX hSession,
DWORD dwParam,
BYTE * pbData,
DWORD * pdwDataLen,
DWORD dwFlags )

#include <dinamo.h>

Retrieves session parameters.

Parameters
[in]hSessionContext acquired through the DOpenSession() function.
[in]dwParamSee dwParam in DSetSessionParam(). Other values for dwParam, exclusive to DGetSessionParam:
Value Meaning
SP_SESSION_ID Type of pbData: DWORD
Server session identifier.
Not yet supported.
SP_SESSION_CIPHER Type of pbData: char *
Algorithms negotiated in the TLS session. Maximum size MAX_CHANNEL_CIPHER_NAME_LEN
SP_SESSION_PIX_HTTP_RET Type of pbData: long *
HTTP response code of the last PIX HTTP request (POST, GET...) made in this session. This operation must be called immediately after calling the PIX request API. It must be called using the same session. Do not perform any other operations between these calls.
SP_SESSION_PIX_HTTP_REQ_DETAILS Type of pbData: PIX _HTTP_REQUEST_DETAILS *
Details of the last PIX HTTP request (POST, GET...) made in this session. This operation must be called immediately after calling the PIX request API. It must be called using the same session. Do not perform any other operations between these calls.
SP_HSM_OP_MODE Type of pbData: DWORD *
HSM operating mode. Can have the values DN_HSM_OP_NRM, DN_HSM_OP_RM1, DN_HSM_OP_RM2 etc.
SP_SESSION_CACHE_TIMEOUT pbData type : DWORD
Timeout in seconds for the session to remain in the cache. See DSetSessionParam() for details.
[out]pbDataPointer to the data or structures specified in dwParam. This parameter can be NULL to specify the amount of memory required.
[in,out]pdwDataLenPointer to the buffer size, in bytes, specified in pbData. When the function returns, this parameter will contain the size of the data stored in pbData.
[in]dwFlagsReserved for future use (must be 0).
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.

◆ DGetSessionCacheCount()

int AAP_API DGetSessionCacheCount ( void )

#include <dinamo.h>

Returns the total number of sessions in the session cache.

Returns
Number of sessions in the cache. A negative value indicates an internal error.]
Notes
Do not use this API too frequently, as it may negatively impact session opening performance by causing locking in the session cache subsystem.

◆ DCloseSession()

int AAP_API DCloseSession ( HSESSIONCTX * phSession,
DWORD dwFlags )

#include <dinamo.h>

Ends a session with Dinamo and releases its context.

Parameters
[in,out]phSessionPointer to the session context. Upon function return, this parameter will be NULL.
[in]dwFlagsChanges certain behaviors of the function; can be zero.
Value Meaning
CLOSE_PHYSICALLY Forces the physical closure of the session. If the session is cached, it will be removed from the cache and physically closed.
Returns
0 (ZERO) if the function is successful.
Refer to the Return Codes section for other values.
Notes
Once released, the session context becomes invalid for use in any other function. If the context is reused, the function will return the D_INVALID_CONTEXT error code.
Examples
ckd_bchain.c, ckd_bchain_ed25519.c, connect_hsm.c, create_hash.c, crypt_sym.c, crypt_sym_gcm.c, crypt_sym_gcm_iv_auto.c, download_log.c, eft_calc_arpc.c, eft_merge_lmk_encrypt.c, eft_validate_cvv.c, export_import_tr31.c, gen_check_oath.c, gen_csr.c, gen_dh.c, gen_dukpt.c, gen_ecdh.c, gen_xecdh.c, get_hsm_info.c, get_key_info_bchain.c, get_pub_key_bchain.c, get_rt_logs.c, import_export.c, import_export_bchain.c, key_add_remove.c, key_attribute.c, list_keys.c, m_of_n.c, ocra_gen.c, pin_block_translate.c, pkcs7_sign.c, post_put_get_delete_pix.c, pqc_kem_encaps_decaps.c, pqc_kem_encaps_decaps_persistent.c, sc_copy_set.c, sc_create_svmk.c, sign_check_pix_jws.c, sign_verify.c, sign_verify_bchain.c, sign_verify_dict.c, sign_verify_dsa.c, sign_verify_eddsa.c, sign_verify_pix.c, sign_verify_pqc_ml_dsa.c, sign_verify_pqc_slh_dsa.c, sign_verify_xml.c, skeep_new_split_recover.c, skeep_probe_match.c, spb_activate_deactivate_cert.c, spb_enc_dec.c, spb_gen_key_csr.c, spb_get_cert.c, spb_import_p12.c, tokenization.c, user_add_remove.c, user_otp.c, and verify_pin_block.c.

◆ DFinalize()