When logging into SSL-Explorer I am sometimes prompted for my password, even though I selected an authentication scheme that does not contain the Password module?

SSL-Explorer allows the storage of confidential attributes, these attributes are stored securely on the server by encrypting them with a public/private key pair. In order to protect this data the private key must be encrypted using a suitable passphrase.

The default behaviour of SSL-Explorer is to encrypt this private key using the users SSL-Explorer password. So when logging in for the first time after a restart of the server the user will be prompted to enter their password so that the server can decrypt the key and gain access to the confidential attributes.

The user will also be prompted to enter their old password if the password changes outside of SSL-Explorer, for example in an Active Directory environment.

You can change this behaviour using the options under System Configuration/Security Options/Confidential Attributes. If set to "Prompt" the user will be required to enter a unique passphrase independent of their password, if set to "Disabled" the user will not be prompted and confidential attributes will not be available.

Why am I prompted for my password when accessing a resource?

There are also times when accessing a resource that you may be prompted for your password. This happens again when you have logged into the system using an authentication scheme that does not contain the Password module.

In this situation the resource is using the ${session:password} attribute so that it can pass authentication details onto the resource. In order to do this the system will prompt you for the password before forwarding you to the resource.