Skip to main content

Modify smart credential authenticator settings

Before you assign smart credentials to users, review smart credential authenticator settings and update them as needed. You can also change these settings after assignment. Changes apply to all smart credentials assigned in your IDaaS account.

IMPORTANT

You must complete the prerequisites before you can create smart credentials. See Manage smart credentials.

Modify smart credential authenticator settings​

Complete these steps to configure smart credential authenticator settings:

  1. Click > Policies > Authenticators. The Authenticators page appears.

  2. Select Smart Credential. The Smart Credential settings appear.

  3. Set PIN Prompt to Session or Transaction. This setting defines when the smart credential app prompts users for their PIN during authentication.

  4. Select the Hardware Store setting to store generated keys in hardware as follows:

    1. Select Required to store the generated keys in hardware storage. If you select Required, a StrongBox checkbox appears.
    2. Select StrongBox to require that Android keys on the device are generated by StrongBox keymaster.
    3. Select Best Option to allow the device to choose the most secure available storage for generated keys.
    note

    The Required option does not support RSA keys on iOS. In addition, Secure Enclave (iOS hardware storage) supports only NIST Curve P-256.

  5. By default, Application Launch Scheme is set to igmobilesc. If you use a custom mobile smart credential app, enter the URL scheme used in that app's activation URL.

  6. Set Session Timeout (min) to the number of minutes a user has to respond to a smart credential authentication challenge. The allowed range is 1 to 2 minutes.

  7. Select Allow Unsecure Device to allow the mobile smart credential app to run on devices where operating system restrictions have been bypassed.

  8. Select Allow Fingerprint Authentication to allow the mobile smart credential app to accept fingerprint authentication instead of a PIN.

    note

    Device fingerprint authentication can allow fallback to the device PIN. That PIN can be shorter (4 digits) than the card PIN (8 digits). For more information, see Manage device fingerprint attributes.

  9. Select Change PIN After Activation to require users to change their card PIN after they activate the smart credential app in their IDaaS account. This option is selected (true) by default.

  10. Select Allow the mobile application to accept facial recognition authentication instead of PIN to allow facial recognition instead of a PIN.

  11. Set Activation Password Length to the number of digits required for the mobile smart credential activation password.

  12. Set Activation Lifetime (min) to the number of minutes a user has to activate their mobile smart credential.

  13. Select Allowed Smart Credentials Definitions from the drop-down list. You can select more than one. At least one smart credential definition is required to create a smart credential authenticator.

  14. Click Save to confirm the changes.

Validate your changes​

After you save, verify the following:

  1. Updated settings are retained after page refresh.
  2. Allowed smart credential definitions match your deployment requirements.
  3. A test user can complete authentication with the expected PIN and biometric behavior.