Configuring ActivClient for Linux

ActivClient behavior can be customized by editing the following configuration files in the specified order and then applying any desired environment overrides:

  1. The system configuration file, located in the following directory:

    /etc/activclient-9.ini

  2. User configuration files, determined as follows:

    • If $XDG_CONFIG_HOME is set and identifies an existing directory, ActivClient uses:

      $XDG_CONFIG_HOME/activclient-9.ini

    • Otherwise, if $HOME/.config exists, ActivClient uses:

      $HOME/.config/activclient-9.ini

    • Otherwise, if $XDG_CONFIG_DIRS is set, its value is interpreted as a colon-separated list of directory paths. ActivClient reads every activclient-9.ini file that exists in those directories.

  3. If an environment variable named ACTIVCLIENT_ followed by a configuration name is set (for example, ACTIVCLIENT_LOGGING_ENABLED), its value overrides the corresponding configuration-file value.

User-Configurable Options

The /etc/activclient-9.ini configuration file contains all configuration options, with brief descriptions and commented-out default values.

The following options are intended for user configuration. To configure an option, remove the comment marker (#) before its name and specify the required value.

Warning! Do not modify options other than those listed below unless instructed to do so by support.

This configuration option specifies whether ActivClient checks if connected devices can be updated with content updates available in the HID CMS HID Credential Management System (formerly known as ActivID Credential Management System) is a web-based, smart card, credential and application lifecycle management system. HID CMS augments and works in concert with an enterprise’s primary identity management infrastructure components, including popular directory, database, and PKI components.. If updates are available, ActivClient Agent displays a notification indicating that a token update is available.

Note: If this setting is enabled, the ACAGENT_CMS_URL option must also be enabled, and a valid URL must be specified for ActivClient to perform the token auto-update check.
Copy 
####################################################################
# Enable checking with the CMS server whether there is a pending token update.
# default: false
# ACAGENT_CMS_TOKEN_AUTOUPDATE_ENABLED = false

This configuration option specifies the connection URL for the HID CMS server (see the HID CMS documentation).

Example: http://cms.mycompany.com

Copy 
####################################################################
# The url of the CMS server which can be checked for pending token updates.
# default:
# ACAGENT_CMS_URL = 

This configuration option specifies how often ActivClient checks for updates, in minutes. If this option is not configured, ActivClient checks for updates every 15 minutes.

Copy 
####################################################################
# Check with the CMS server once every specified number of minutes
# default: 15
# ACAGENT_CMS_AUTOUPDATE_CHECK_INTERVAL_MINUTES = 15

This configuration option specifies whether ActivClient generates log files for every action performed. No security-sensitive information is logged.

Note: Logging of all actions may affect performance and should be activated only when required by Support for troubleshooting purposes.
Tip! Logging can also be enabled or disabled in ActiveClient Console (under Settings > Logging & Diagnostics) and from ActivClient Agent.
Copy 
####################################################################
# Enable Logging
# default: false
# LOGGING_ENABLED = false

This configuration option allows you to specify smart card and USB security key readers that are not authorized for use with ActivClient. Enter the names of the blocked readers as a semicolon-separated list.

Important: A token inserted into a blacklisted reader will not be usable by ActivClient for any operations.
Note: The reader name list is case-sensitive. Use the reader name as reported in the ActivClient Console > Devices view.
Copy 
####################################################################
# Ignore readers matching the provided ';'-separated patterns
# default: 
# READER_BLACKLIST = 

This configuration option defines if PIN unblock using a PUK is allowed for cards that do not contain an object indicating the presence of a PUK. If this option is not enabled, ActivClient does not allow PIN unblock using a PUK for such cards.

Copy 
####################################################################
# Create PUK role on C2300 cards even if the marker objects does not exist
# default: false
# C2300_ENFORCE_PUK_EXISTENCE = false

This configuration option specifies the locale used for translated messages in other languages than English.

  • If the option is not configured, ActivClient uses the operating system locale. For example, if the operating system locale is set to Polish, messages are displayed in Polish.

  • If the option is configured with the value pl, messages are displayed in Polish regardless of the operating system locale.

  • If no translation is available for the selected locale, messages are displayed in English.

Copy 
####################################################################
# If nonempty, specifies the locale used for translated messages instead of the OS default
# default:
# I18N_LOCALE_OVERRIDE = pl