Use a smart card on Mac
Overview
The default method of smart card usage on a Mac is to pair a smart card to a local user account. This method occurs automatically when a user inserts their card into a card reader attached to a computer. The user is prompted to “pair” the card with their, which requires administrator access, because pairing information is stored in the user’s local directory account. This method is called local account pairing. If a user doesn’t pair their card when prompted, the user can still use the card to access websites but is unable to log in to their user account with the smart card.
Note: Smart cards used with Platform Single Sign-on or a directory service don’t need to be paired.
To use the smart card for login:
Use Platform Single Sign-on with smart card authentication
Pair the smart card to a local user account
Configure the Mac with a directory service
Local account pairing
The steps below describe the local account pairing process:
Insert a PIV smart card or hard token that includes authentication and encryption identities.
Select Pair at the notification dialog.
Provide administrator account credentials (user name/password).
Provide the four-to-six-digit personal identification number (PIN) for the inserted smart card.
Log out and use the smart card and PIN to log back in.
Local account pairing can also be accomplished with the command-line and an existing account. For more information, see Configure a Mac for smart card–only authentication.
Attribute mapping with an identity provider
You can use smart cards to authenticate against an identity provider (IdP) using Platform Single Sign-on or Active Directory (with attribute mapping). This method involves setting appropriate matching fields in the file /private/etc/SmartcardLogin.plist. This file needs to have world-readable permissions to function properly. The following fields in the PIV Authentication certificate can be used to map attributes to corresponding values in the directory account:
Common Name
RFC 822 Name (email address)
NT Principal Name
Organization
OrganizationalUnit:1
OrganizationalUnit:2
OrganizationalUnit:3
Country
Multiple fields may also be concatenated to produce a matching value in the directory and presence of the SmartcardLogin.plist file takes precedence over paired local accounts.
Before the user can take advantage of this feature, their Mac needs to be configured with the appropriate attribute mapping and the local pairing user interface needs to be turned off using a smart card configuration profile or the following command (requires administrator permissions):
sudo defaults write /Library/Preferences/com.apple.security.smartcard UserPairing -bool NO
As soon as the Mac is configured for on-demand account creation using Platform Single Sign-on or bound to an Active Directory, a user simply inserts a smart card or token to create a new user account. They’re prompted to enter their pin and create a unique keychain password that is wrapped by the encryption key in the smart card.
To allow offline login for mobile accounts, select the “Create mobile account at login” preference . This mobile user feature is supported with Kerberos attribute mapping, and configured in the Smartcardlogin.plist file. This configuration is also useful in environments where a Mac may not always be able to reach directory server. However, initial account setup requires machine binding and access to the directory server.
Note: If you’re using mobile accounts, the first time one is created, the initial login needs to use the associated password of the account. This process ensures a secure token is obtained so further logins can unlock FileVault. After the initial password-based login, smart card-only authentication can be used.
Local user account with attribute mapping example
Below is an example SmartcardLogin.plist file, where mapping correlates the NT Principal Name on the PIV Authentication certificate to match the AltSecurityIdentities attribute in the local user account:
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"> <dict> <key>AttributeMapping</key> <dict> <key>fields</key> <array> <string>NT Principal Name</string> </array> <key>formatString</key> <string>Kerberos:$1</string> <key>dsAttributeString</key> <string>dsAttrTypeNative:AltSecurityIdentities</string> </dict> </dict></plist>Network user account with attribute mapping example
Below is an example SmartcardLogin.plist file where mapping correlates the Common Name and the RFC 822 Name on the PIV Authentication certificate to match the longName attribute with the IdP:
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"> <dict> <key>AttributeMapping</key> <dict> <key>fields</key> <array> <string>Common Name</string> <string>RFC 822 Name</string> </array> <key>formatString</key> <string>$1</string> <key>dsAttributeString</key> <string>dsAttrTypeNative:longName</string> </dict> </dict></plist>Enable the screen saver on token removal
The screen saver can be configured to start automatically when a user removes their token. This option appears only after a smart card has been paired. There are two main ways to accomplish this:
Deploy a smart card payload with the token removal action set to 1.
In Privacy & Security settings on the Mac, use the Advanced button and select “Turn on screen saver when login token is removed.” Make sure the screen saver settings are configured, then select “Require a password immediately after sleep or screen saver begins.”