How to correctly handle New PIN Rejected in custom RSA Authentication Agent
3 years ago
Originally Published: 2004-08-23
Article Number
000057982
Applies To
RSA ACE/Agent 5.0.3 Authentication API
Issue
How to correctly handle New PIN Rejected in custom RSA Authentication Agent
SD_Pin(...) returns resultcode 1 (ACM_ACCESS_DENIED)
Cause

Calling API function SD_Pin() when not in new PIN mode is invalid and returns ACM_ACCESS_DENIED. In the code segment below, the call "SD_Pin(SdiHandle, "") is equivalent to AceCancelPin() and aborts the new pin processing:
 

int iRes;

iRes = SD_Pin(SdiHandle,sNewPin);   //invalid PIN

if( iRes!= ACM_NEW_PIN_ACCEPTED)

{

      SD_Pin(SdiHandle, "");   //ABORTS new pin processing!!

      //.. User prompted for new pin, user enters valid pin

      iRes= SD_Pin(SdiHandle , sNewPin );

      // return value unexpectedly = ACM_ACCESS_DENIED

} 

Resolution

To correct this issue, remove the SD_Pin(SdiHandle, "") call as shown below:

 

int iRes;

iRes = SD_Pin(SdiHandle,sNewPin);  //invalid PIN

if( iRes!= ACM_NEW_PIN_ACCEPTED)

{

      //.. User prompted for change pin, user enters valid pin

      iRes= SD_Pin(SdiHandle , sNewPin );

      // return value reflects valid attempt to set the PIN

}