<div class="content"><p> </p><p>This enumeration describes bitmask flags that can be set on
authentication proposals.</p><dl>
<dd>
<div><pre> typedef  enum _tag_FW_AUTH_SUITE_FLAGS
 {
   FW_AUTH_SUITE_FLAGS_NONE = 0x0000,
   FW_AUTH_SUITE_FLAGS_CERT_EXCLUDE_CA_NAME = 0x0001,
   FW_AUTH_SUITE_FLAGS_HEALTH_CERT = 0x0002,
   FW_AUTH_SUITE_FLAGS_PERFORM_CERT_ACCOUNT_MAPPING = 0x0004,
   FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256 = 0x0008,
   FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384 = 0x0010,
   FW_AUTH_SUITE_FLAGS_INTERMEDIATE_CA = 0x0020,
   FW_AUTH_SUITE_FLAGS_ALLOW_PROXY = 0x0040,
   FW_AUTH_SUITE_FLAGS_MAX = 0x0080,
   FW_AUTH_SUITE_FLAGS_MAX_V2_1 = 0x0020
 } FW_AUTH_SUITE_FLAGS;
</pre></div>
</dd></dl><p><b>FW_AUTH_SUITE_FLAGS_NONE:  </b>This value means
that none of the following flags are set. This value is defined for simplicity
in writing <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_73177eec-4092-420f-92c5-60b2478df824" data-linktype="relative-path">IDL</a></span> definitions and
code.</p><p><b>FW_AUTH_SUITE_FLAGS_CERT_EXCLUDE_CA_NAME:  </b>If
this flag is set, <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_c925d5d7-a442-4ba4-9586-5f94ccec847a" data-linktype="relative-path">certificate authority (CA)</a></span>
names are excluded. This flag MUST be set only on first authentications.</p><p><b>FW_AUTH_SUITE_FLAGS_HEALTH_CERT:  </b>This flag
specifies that the certificate in use is a health certificate. On second
authentications, if the authentication method is using a machine certificate,
this flag MUST be specified. Also on second authentications, if the
authentication method is using a user certificate, this flag MUST NOT be
specified.</p><p><b>FW_AUTH_SUITE_FLAGS_PERFORM_CERT_ACCOUNT_MAPPING: 
</b>This flag specifies that the certificate that is used maps to an account.</p><p><b>FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA256:  </b>This
flag specifies that the default certificate signing algorithm of <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_3f85a24a-f32a-4322-9e99-eba6ae802cd6" data-linktype="relative-path">RSA</a></span>
MUST be replaced by the Elliptic Curve Digital Signature Algorithm (ECDSA)
using curves with a 256-bit prime moduli.</p><p><b>FW_AUTH_SUITE_FLAGS_CERT_SIGNING_ECDSA384:  </b>This
flag specifies that the default certificate signing algorithm of RSA MUST be
replaced by the Elliptic Curve Digital Signature Algorithm using curves with a
384-bit prime moduli.</p><p><b>FW_AUTH_SUITE_FLAGS_INTERMEDIATE_CA:  </b>This
flag specifies that the certificate used is not from a root certificate authority
but from an intermediate authority in the chain.</p><p><b>FW_AUTH_SUITE_FLAGS_ALLOW_PROXY:  </b>This flag
specifies that the host machine MUST use a proxy server to communicate with the
<span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_6e5aafba-6b66-4fdd-872e-844f142af287" data-linktype="relative-path">Key
Distribution Center (KDC)</a></span> when performing <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_d6a282ce-b1da-41e1-b05a-22f777a5c1fe" data-linktype="relative-path">Kerberos</a></span>
authentication. For schema versions 0x0200, 0x0201, and 0x020A, this value is
invalid and MUST NOT be used.</p><p><b>FW_AUTH_SUITE_FLAGS_MAX:  </b>This value and values
that exceed this value are not valid and MUST NOT be used. It is defined for
simplicity in writing IDL definitions and code. This symbolic constant has a
value of 0x0080.</p><p><b>FW_AUTH_SUITE_FLAGS_MAX_V2_1:  </b>This value and
values that exceed this value are not valid and MUST NOT be used by servers and
clients with schema version 0x0201 and earlier. It is defined for simplicity in
writing IDL definitions and code. This symbolic constant has a value of 0x0020.</p></div>