Four industries. One common requirement: attributable Windows logon.

What's hard here

Clinical staff sign in and out dozens of times a shift. Passwords get written under keyboards. Shared accounts make access-trail reconstruction impossible. The contactless and PKI cards your hospital already issues can serve as logon tokens, but typically aren't wired into Windows out of the box.

German clinics: the regulatory map

German hospitals and practices answer to a denser stack of obligations than almost any other sector. CodeB is deployed in this environment because it lines up cleanly with each one:

• DSGVO & BDSG — patient records are special-category data under Art. 9 GDPR. Per-user authentication is the foundation of any defensible data-protection impact assessment. Shared accounts undermine that on day one.
• § 203 StGB — Verschwiegenheitspflicht — German criminal law holds doctors, dentists and clinical staff personally responsible for protecting patient secrecy. Strong, attributable Windows logon makes the technical case that access was constrained to authorised individuals.
• § 75c SGB V — since 2022, every German hospital must implement IT security "nach dem Stand der Technik". The Bundesärztekammer and DKG read this as mandating MFA on clinical workstations. CodeB is the MFA layer sitting at the Windows logon screen itself.
• B3S Krankenhaus & KRITIS — the industry-specific security standard for hospitals under § 8a BSIG. Section 5 (Identity and Access Management) explicitly requires strong authentication for clinical systems. CodeB delivers that without bolting on a separate IAM platform.
• KHZG funding — the Krankenhauszukunftsgesetz earmarked 15 % of digitalisation funds specifically for IT security. CodeB qualifies as an eligible measure under FT 10 (IT security), so the rollout is fundable through your KHZG-Antrag.

How CodeB is deployed

Featured case study

Automatic logon to T2Med (Java clinic software).

T2Med is the Java-based clinic software in widespread use across primary-care practices. With CodeB, the clinician taps an NFC card once and lands inside T2Med, already signed in — no Windows password, no T2Med password, no TOTP code typed by hand.

Watch · T2Med auto-logon demo

How it works

The CodeB Credential Provider secures the Windows logon with a second factor — NFC card or TOTP — and at the same time enables passwordless logon. An authorised NFC card or TOTP code fully replaces the username-and-password step. Hold a registered card to the reader and the Windows session opens.

The bundled Web SSO engine extends the same authentication into web apps, classic Windows apps and Java-based desktop applications. It detects the application's login window, fills the right credentials, and — if a TOTP code is required — calculates and enters it. T2Med is the reference example: in the CodeB Web SSO manager you assign one or more NFC cards to a T2Med account, and T2Med is signed in only while an assigned card is on the reader.

If the card is already on the reader when T2Med opens, sign-in happens at once; if T2Med opens first, it signs in the moment the card is tapped. One T2Med entry can hold several accounts, each with its own card — the card on the reader decides which clinician is signed in, and a card that belongs to none of them falls back to the account with no card assigned.

Five-step setup

1. Download CodeB. Get codeb_tray.zip from our download site.
2. Install the Credential Provider and start the tray helper. Run CredentialProviderInstaller.exe from the zip, click Install Credential Provider, then start codeb_tray.exe — the process that injects credentials into T2Med at runtime.
3. Add a domain for T2Med. Open the CodeB Web SSO manager (titled Web SSO User Manager), click + Add Domain, enter t2med and click Done. The built-in T2Med profile and a t2user demo account are created (demo server demo.t2med.com, user t2user, no password) — replace it with your own credentials or add more users as needed.
4. Assign the clinician's card. Select the account and tap the user's NFC card on the reader while the manager is open; the card number fills in automatically. Several cards on one account? Enter them comma-separated.
5. Optional — log off when the card is removed. Tick Log off when the card is removed on the T2Med entry, then click Save.

Hands-free sign-out

Log off when the card is removed

Tick one box on the T2Med entry and CodeB signs the clinician out of T2Med the moment they lift their card off the reader — it sends T2Med's own log-off shortcut, Ctrl + Shift + Q. A roughly three-second grace period means a quick tap, or a card that slips, never logs anyone off. No shared workstation is left standing open on a patient record when the clinician walks away.

• Grace period. The log-off waits about 3 seconds after the card is removed (the card is polled once a second, so 3–4 seconds in practice); put the card back within that window and nothing happens. The wait is its own setting — HKLM\SOFTWARE\WOW6432Node\CodeB\Config\LogoffDelaySec (seconds, 0–3600, default 3), separate from the Windows card-removal delay — and an application profile can set its own.
• Card logons only. A session that was filled in without a card is never logged off by removing a card.
• It reaches T2Med safely. If the clinician is in another window, T2Med is brought to the front just long enough for the shortcut to land. If Windows refuses to bring it forward, CodeB sends nothing — it never types into another program — and gives up after a few tries. If T2Med already shows its login screen, nothing is sent.
• Off by default. Existing installations behave exactly as before until the box is ticked; the T2Med profile upgrades itself automatically and keeps any fields an administrator changed.
• Not only T2Med. Any application with its own log-off shortcut works — put the key combination in that application's login profile (LogoffKeys, Windows SendKeys notation: ^ Ctrl, + Shift, % Alt) and tick the same box.

Result: the clinician taps to land inside T2Med already signed in, and lifts the card to sign straight back out — no Windows password, no T2Med password, no TOTP code typed by hand.

Several clinic workstations? CodeB can sync the same cards and Web SSO logins across every computer.

What's hard here

OT environments tolerate very little disruption. Updating Windows is a quarterly event, not a Tuesday. Operators wear gloves; touchscreens are clumsy; cards get lost. Yet NIS2 and customer audits now demand individual attribution of every action that touches the MES.

How CodeB is deployed

What's hard here

OEM machine controllers are built on whatever Windows version was current when the machine left the factory — and they stay in service for ten to twenty years, often on networks with no internet at all. The HMI typically has two user populations: the shift operator who runs the machine, and the service engineer who reconfigures it. Both need attributable logon, and increasingly under NIS2 because the host industry (food, pharma, energy, water, manufacturing of essential goods) is in scope.

How CodeB is deployed

What's hard here

Office environments are heterogeneous: laptops on the road, desktops on-prem, Azure Virtual Desktop for contractors. Auditors expect cryptographically attributable logon — but most environments still rely on a password and a SMS code, both phishable.

How CodeB is deployed