> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure smart credential definitions

A smart credential definition can include two digital ID types:

- **Card.** Identifies the card.
- **Card holder.** Identifies the user who owns the card.

These digital IDs define how the credential and credential owner are identified during issuance and use.

When you create a smart credential, the definition supplies digital ID configuration values. If defaults are configured in the definition, the new smart credential uses those defaults automatically. If defaults are not configured, you must provide those values during credential setup.

Before you create a smart credential for a user, confirm the following:

- If a digital ID type is marked as required in the smart credential definition, that digital ID must be set for the user smart credential.

## Create smart credential definitions

1. Click Menu icon **>** **Resources** **> Smart Credential Definitions**. The **Smart Credential Definitions** page appears.
2. Click **Add**. The **Add Smart Credential Definition** page appears.
3. Enter a **Name** for your smart credential definition.
4. Set **Lifetime** to the number of months before the smart credential expires. The default value is `60` (five years). The value can range between `1` month and `120` months (ten years).
5. Select the **PIV Applet Config** from the drop-down list. This setting specifies how information is encoded into the smart credential. The options include:
   - PIV with Challenge Response PIN unblock
   - Yubico YubiKey PIV
   - PIV with PIN multi use

### Define the **Digital ID Settings** for your smart credential application

You can create a smart credential definition without a card or card holder digital ID. However, if you want to use a smart credential for Windows SCLO or IDaaS smart credential push authentication, your smart credential must include a card holder digital ID.

**To add a digital ID to the Smart Credential:**

1. Select the **Default Card Digital ID** from the drop-down list. Your configured CA on IDaaS contains the card digital ID. If you do not want to create a digital ID, select **Not Set**.

2. Select **Digital ID is required** to require your smart credential definition to have a digital ID. Do not select this option if you do not want to assign a digital ID to a smart credential.

3. Select **Card Digital ID is Required** to require a card digital ID before the smart credential definition can be encoded.

4. Select the **Default Card Holder Digital ID** from the drop-down list.

5. Select **Card Holder Digital ID is Required** to require a card holder digital ID as the **Default Card Holder Digital ID** before the smart credential definition can be encoded. This setting specifies the CA that contains the PIV content signer.

6. Optionally, select an explicit CA that contains the PIV content signer from the drop-down list.

note
If you create a smart credential without a digital ID, you must select the CA that contains the PIV content signer.

### Define the Smart Credential PIN settings

These settings apply to PINs for mobile smart credential application user accounts. They define what can and cannot be included in a user PIN.

**To define the Smart Credential PIN Settings of your smart credential application:**

1. Set **Generated PIN Length** to the number of characters required in each PIN. Users are automatically assigned a system-generated PIN when they are assigned a mobile smart credential.

2. Set **PIN Minimum Length** to the minimum number of characters required in each PIN. After a user signs in to their mobile smart credential application account for the first time, they can change their PIN.

3. Set **PIN Maximum Length** to the maximum number of characters in a customized PIN.

4. Set the **Digits** limitation:

   - **Allowed**
   - **Required**
   - **Not Allowed**
   - **Not Set** (no limitation)

5. Set the **Uppercase Letters** permission:

   - **Allowed**
   - **Required**
   - **Not Allowed**
   - **Not Set** (no limitation)

6. Set the **Lowercase Letters** permission:

   - **Allowed**
   - **Required**
   - **Not Allowed**
   - **Not Set** (no limitation)

7. Set the **Special Characters** conditions:

   - **Allowed**
   - **Required**
   - **Not Allowed**
   - **Not Set** (no limitation)

8. Set **Maximum Uses After Admin Reset** to the number of times a user can sign in using a newly encoded PIN or a PIN provided to unlock their account before they must change it.

   > The default value is `-1`. The `-1` value indicates that the PIN can be used any number of times.

9. Set **Maximum Allowed Attempts** to the number of failed login attempts required to lock a user out of their mobile Smart Credential authenticator application.

### Define the Definition Variables

The **Definition Variables** are used to generate the mobile smart credential. For a smart credential definition to function properly, you must add all variables listed in the certificate authority associated with the smart credential definition.

**To define the Definition Variables:**

1. Click **Add**.
2. Select the variable type:
   - **String.** Text value.
   - **Boolean.** `true` or `false` value.
   - **Integer.** Whole number value.
   - **UUID.** Unique identifier value.

> The **Smart Credential Definition Variable** dialog box appears.

4. Enter a **Name** for the definition variable.

   > This is the variable name used by the certificate authority in IDaaS CA digital ID configuration definitions, including variables, subject alternative names, and CA distinguished name (DN).

5. Enter a **Prompt** value that clearly represents the meaning of the variable.
   > This text identifies the variable in the smart credential details and on the **Authenticators** page.

note

Depending on the selected **Type**, some settings in the next steps might not be editable.

6. Enter the **Random Value Generation Settings**:

   1. Select **Generate Variable** to generate a random value as the initial value for the variable. You may want to select this field if the variable being created is a universally unique identifier (UUID).

   2. Set **Generate Length (Required)** to the number of characters included in the generated value.

   3. Enter the **Character Restrictions**. These settings limit what can be entered as the variable value.

   4. Set the **Restriction Minimum**.

      - **String.** Defines the minimum required string length.
      - **Integer.** Defines the minimum integer value that can be entered.

   5. Set the **Restriction Maximum**.

      - **String.** Defines the maximum allowed string length.
      - **Integer.** Defines the maximum integer value that can be entered.

   6. In **Restriction Regex**, enter an expression that the variable value must match.

      > For example, with the regex `.+@.+\\..+`, an email-style value must contain one or more characters, followed by `@`, then one or more characters, followed by `.`, then one or more characters.

   7. Set the **Digits** restrictions:

      - **Allowed**
      - **Required**
      - **Not Allowed**
      - **Not Set** (no limitation)

   8. Set the **Uppercase Letters** permission:

      - **Allowed**
      - **Required**
      - **Not Allowed**
      - **Not Set** (no limitation)

   9. Set the **Lowercase Letters** permission:

      - **Allowed**
      - **Required**
      - **Not Allowed**
      - **Not Set** (no limitation)

   10. Set the **Special Characters** conditions:
   - **Allowed**
     - **Required**
     - **Not Allowed**
     - **Not Set** (no limitation)

7. Enter values for the **Uniqueness** settings.

   > The uniqueness settings define how other variables can share values with the variable being created.
   - **Global**
   - **User**
   - **None**

8. From the **Scope** drop-down list, select the name of the variable that you want to apply to this uniqueness level.

> For example, in the default IDaaS smart credential definition, **lastname** is specified as **User unique** for the **Scope** of the **firstname** variable. This means two smart credentials for the same user can have the same **firstname** and **lastname**. However, two smart credentials for different users can have the same **firstname** or the same **lastname**, but not the same **firstname** and **lastname** combination.

note

A variable can be selected as the uniqueness **Scope** of a new variable only if another variable has already been created and saved to the smart credential definition. The first variable created in a new smart credential definition has no scope options because no other variables exist yet.

9. Enter values for the **Other** settings.

   1. For **Default Value**, enter the default value for the variable. This can be a user attribute name, a constant value, or multiple user attribute names. Enter the value enclosed in angle brackets.

note
Setting **Default** to `<User Principal Name>` causes the IDaaS user attribute **UPN** to auto-populate any smart credential created for that user. The **Default** field is not case-sensitive.

::: 2. Select **Is Required** to require that a value be provided for this variable when a smart credential is configured. 3. Select **Is Displayable** to allow the value of this variable to be viewed by others. 4. Select **Is Modifiable** to allow the value of this variable to be modified after a value is entered for the variable.

### Add the variable definition

1. When you have finished the configuration, click **Add**. The variable appears in the smart credential definition list.
2. After you have added all of the definition variables, click **Save**. The definition appears on the **Smart Credential Definitions** page.

The smart credential definition is ready to be applied to a mobile smart credential. You can assign a mobile smart credential to users, provided that at least one certificate authority is ready for use. See [Manage certificate authorities](/docs/authentication-and-security/manage-certificate-authorities.md) for more information.