Configure smart credential definitions

A smart credential definition can include two digital ID types:

• Card. Identifies the card.
• Card holder. Identifies the user who owns the card.

These digital IDs define how the credential and credential owner are identified during issuance and use.

When you create a smart credential, the definition supplies digital ID configuration values. If defaults are configured in the definition, the new smart credential uses those defaults automatically. If defaults are not configured, you must provide those values during credential setup.

Before you create a smart credential for a user, confirm the following:

• If a digital ID type is marked as required in the smart credential definition, that digital ID must be set for the user smart credential.

Create smart credential definitions

1. Click > Resources > Smart Credential Definitions. The Smart Credential Definitions page appears.
2. Click Add. The Add Smart Credential Definition page appears.
3. Enter a Name for your smart credential definition.
4. Set Lifetime to the number of months before the smart credential expires. The default value is 60 (five years). The value can range between 1 month and 120 months (ten years).
5. Select the PIV Applet Config from the drop-down list. This setting specifies how information is encoded into the smart credential. The options include:
   • PIV with Challenge Response PIN unblock
   • Yubico YubiKey PIV
   • PIV with PIN multi use

Define the Digital ID Settings for your smart credential application

You can create a smart credential definition without a card or card holder digital ID. However, if you want to use a smart credential for Windows SCLO or IDaaS smart credential push authentication, your smart credential must include a card holder digital ID.

To add a digital ID to the Smart Credential:

1. Select the Default Card Digital ID from the drop-down list. Your configured CA on IDaaS contains the card digital ID. If you do not want to create a digital ID, select Not Set.

2. Select Digital ID is required to require your smart credential definition to have a digital ID. Do not select this option if you do not want to assign a digital ID to a smart credential.

3. Select Card Digital ID is Required to require a card digital ID before the smart credential definition can be encoded.

4. Select the Default Card Holder Digital ID from the drop-down list.

5. Select Card Holder Digital ID is Required to require a card holder digital ID as the Default Card Holder Digital ID before the smart credential definition can be encoded. This setting specifies the CA that contains the PIV content signer.

6. Optionally, select an explicit CA that contains the PIV content signer from the drop-down list.

   note

   If you create a smart credential without a digital ID, you must select the CA that contains the PIV content signer.

Define the Smart Credential PIN settings

These settings apply to PINs for mobile smart credential application user accounts. They define what can and cannot be included in a user PIN.

To define the Smart Credential PIN Settings of your smart credential application:

1. Set Generated PIN Length to the number of characters required in each PIN. Users are automatically assigned a system-generated PIN when they are assigned a mobile smart credential.
2. Set PIN Minimum Length to the minimum number of characters required in each PIN. After a user signs in to their mobile smart credential application account for the first time, they can change their PIN.
3. Set PIN Maximum Length to the maximum number of characters in a customized PIN.
4. Set the Digits limitation:
   • Allowed
   • Required
   • Not Allowed
   • Not Set (no limitation)
5. Set the Uppercase Letters permission:
   • Allowed
   • Required
   • Not Allowed
   • Not Set (no limitation)
6. Set the Lowercase Letters permission:
   • Allowed
   • Required
   • Not Allowed
   • Not Set (no limitation)
7. Set the Special Characters conditions:
   • Allowed
   • Required
   • Not Allowed
   • Not Set (no limitation)
8. Set Maximum Uses After Admin Reset to the number of times a user can sign in using a newly encoded PIN or a PIN provided to unlock their account before they must change it.

   The default value is -1. The -1 value indicates that the PIN can be used any number of times.

9. Set Maximum Allowed Attempts to the number of failed login attempts required to lock a user out of their mobile Smart Credential authenticator application.

Define the Definition Variables

The Definition Variables are used to generate the mobile smart credential. For a smart credential definition to function properly, you must add all variables listed in the certificate authority associated with the smart credential definition.

To define the Definition Variables:

1. Click Add.
2. Select the variable type:
   • String. Text value.
   • Boolean. true or false value.
   • Integer. Whole number value.
   • UUID. Unique identifier value.

The Smart Credential Definition Variable dialog box appears.

4. Enter a Name for the definition variable.

   This is the variable name used by the certificate authority in IDaaS CA digital ID configuration definitions, including variables, subject alternative names, and CA distinguished name (DN).

5. Enter a Prompt value that clearly represents the meaning of the variable.

   This text identifies the variable in the smart credential details and on the Authenticators page.

note

Depending on the selected Type, some settings in the next steps might not be editable.

6. Enter the Random Value Generation Settings:

   1. Select Generate Variable to generate a random value as the initial value for the variable. You may want to select this field if the variable being created is a universally unique identifier (UUID).

   2. Set Generate Length (Required) to the number of characters included in the generated value.

   3. Enter the Character Restrictions. These settings limit what can be entered as the variable value.

   4. Set the Restriction Minimum.

      • String. Defines the minimum required string length.
      • Integer. Defines the minimum integer value that can be entered.

   5. Set the Restriction Maximum.

      • String. Defines the maximum allowed string length.
      • Integer. Defines the maximum integer value that can be entered.

   6. In Restriction Regex, enter an expression that the variable value must match.

      For example, with the regex .+@.+\\..+, an email-style value must contain one or more characters, followed by @, then one or more characters, followed by ., then one or more characters.

   7. Set the Digits restrictions:

      • Allowed
      • Required
      • Not Allowed
      • Not Set (no limitation)

   8. Set the Uppercase Letters permission:

      • Allowed
      • Required
      • Not Allowed
      • Not Set (no limitation)

   9. Set the Lowercase Letters permission:

      • Allowed
      • Required
      • Not Allowed
      • Not Set (no limitation)

   10. Set the Special Characters conditions:

   • Allowed
     • Required
     • Not Allowed
     • Not Set (no limitation)

7. Enter values for the Uniqueness settings.

   The uniqueness settings define how other variables can share values with the variable being created.

   • Global
   • User
   • None

8. From the Scope drop-down list, select the name of the variable that you want to apply to this uniqueness level.

For example, in the default IDaaS smart credential definition, lastname is specified as User unique for the Scope of the firstname variable. This means two smart credentials for the same user can have the same firstname and lastname. However, two smart credentials for different users can have the same firstname or the same lastname, but not the same firstname and lastname combination.

note

A variable can be selected as the uniqueness Scope of a new variable only if another variable has already been created and saved to the smart credential definition. The first variable created in a new smart credential definition has no scope options because no other variables exist yet.

9. Enter values for the Other settings.

   1. For Default Value, enter the default value for the variable. This can be a user attribute name, a constant value, or multiple user attribute names. Enter the value enclosed in angle brackets.
   note

   Setting Default to <User Principal Name> causes the IDaaS user attribute UPN to auto-populate any smart credential created for that user. The Default field is not case-sensitive.

   ::: 2. Select Is Required to require that a value be provided for this variable when a smart credential is configured. 3. Select Is Displayable to allow the value of this variable to be viewed by others. 4. Select Is Modifiable to allow the value of this variable to be modified after a value is entered for the variable.

Add the variable definition

1. When you have finished the configuration, click Add. The variable appears in the smart credential definition list.
2. After you have added all of the definition variables, click Save. The definition appears on the Smart Credential Definitions page.

The smart credential definition is ready to be applied to a mobile smart credential. You can assign a mobile smart credential to users, provided that at least one certificate authority is ready for use. See Manage certificate authorities for more information.