Skip to main content

Add a smart credential

Use this procedure to enroll a smart credential for a user in IDaaS.

Before you begin​

Before you enroll a smart credential, complete the following prerequisites:

  1. Configure certificate authorities
  2. Configure smart credential definitions
  3. Optional: Export a certificate trust chain if your users want to use their smart credential for Windows Smart Card logon.
note

The digital IDs for a smart credential definition should all come from the same certificate authority.

Add a smart credential​

  1. Click > Members > Users. The Users List page appears.

  2. Click the User ID for the user.

  3. Click the Authenticators tab. The Authenticators page appears.

  4. Click . A drop-down list of authenticators appears.

  5. Select Smart Credential. The Smart Credential dialog box appears.

  6. Select the smart credential definition that contains the PIV data model and enrollment variables you want the smart credential to use. You configure these in Configure smart credential definitions.

  7. Click Add. The smart credential appears in the user's list of authenticators.

    note

    A smart credential in the Enrolling state is missing one or more required attributes. For example, if the smart credential definition requires the user's last name and that value is not set in the user profile, the smart credential remains in the Enrolling state. Update the user profile with the missing values, then try again. For more information, see Add users to IDaaS and Edit smart credential settings.

Activate a smart credential​

After you enroll the smart credential, you must activate it. On the user's Authenticators page, do the following:

  1. Click to the right of the smart credential that you want to activate. A drop-down list appears.
  2. If the user has an email, do the following:
    • Click Activate. The Activate Smart Credential dialog box appears.
    • Select the type of smart credential to activate: Mobile Smart Credential or Physical Smart Credential.
    • Click Activate. IDaaS sends the user an email with a QR code and further instructions.
  3. If the user does not have an email, the user must activate the smart credential from the User Portal. See the IDaaS User Online Help for more information.
note

Click and select Re-Activate from the drop-down list to send another email to the user's email address if the first email was not received or the token expired before activation.

Validate your changes​

After you add and activate the smart credential, validate the result.

  1. Confirm the smart credential is in the Enrolled state before activation.
  2. Confirm the smart credential activates successfully.
  3. Confirm all required digital IDs and user attributes have values.
  4. Confirm the user receives the activation email, or can activate from the User Portal if no email is set.