Where is the CA Auth ID(ArcotID) storage location?

Products

• CA Advanced Authentication
• CA Strong Authentication

Issue/Introduction

Where is the CA Auth ID (ArcotID) storage location?

Environment

Release: 9.x
Component: Strong Authentication

Resolution

ArcotID is a secure software credential that provides two-factor authentication. An ArcotID is a small data file that by itself can be used for strong authentication to a variety of clients such as 
Web or Virtual Private Networks (VPNs). ArcotID is not vulnerable to “Brute Force” password attacks or “Man-in-the-Middle” attacks. 
ArcotID is a challenge-response type of authentication method, where WebFort Server sends the challenge to user, the client application using the ArcotID client( Normally Java Script Client is used these days) signs the challenge, The challenge is signed by the PrivateKey present in the ArcotID and only correct PIN/Password will get the correct PK and then sends it to the WebFort Server for validation. The user is authenticated after verifying the signed challenge.
ArcotID is stored in the ARWFARCOTID table and it is a Base64 string of the ArcotID, the contents are non-readbale.

ArcotID Storage
The download of an ArcotID can be done either for the current session or permanently. This is identified by the storage medium that will be selected while downloading the ArcotID. This section lists the storage medium supported by ArcotID Clients.

• JavaScript Client

JavaScript ArcotID Client supports the following types of storage medium:

In Memory Storage
The ArcotID is downloaded to memory, and this is available only for the current session. The user has to re-download the ArcotID if required for the successive sessions.

Permanent Browser Storage
The ArcotID JavaScript Client supports HTML5 standard to store ArcotIDs in the Web browser. According to this standard, the ArcotID is stored permanently in the Web browser and is available across sessions.

Note: If an older version of the Web browser that does not support HTML5 standard is used to download the ArcotID, then the ArcotID is stored as a permanent browser cookie. In such cases, there is a restriction on cookie size, therefore a user can store only one ArcotID on their system.