Smart Login set up checklist

Use this checklist with the following documentation to set up Smart Login with IDaaS:

• Service Provider documentation (required for Service Provider administrators only)
• Entrust Identity Help (available in the Entrust Identity app)

Step	Task	Supporting Documentation and Notes
1	To use Smart Login, your IDaaS account must include a Smart Login entitlement. Note: Smart Login entitlements are assigned by your Service Provider Administrator.	Service Provider documentation
2	Ensure that users have a smart credential authenticator.	Assign a smart credential to users (see Manage smart credentials). Note: Users can also add their own smart credential authenticator. See step 10. Optional: Modify the Registration settings to automatically enroll a smart credential for new users. See Configure user registration. Users add their own smart credential authenticator.
3	Users activate their smart credential.
4	Configure a Certificate Authority	See Manage Certificate Authorities. If using a Microsoft CA, you must Create and configure a gateway and add a directory. If using an Entrust Managed PKI CA, creating a gateway and directory is optional.
5	Set the default digital ID configurations in the PIV template.	See Configure smart credential definitions.
6	Map a User Principal Name user attribute for Smart Login.	If you have synced user data with your directory (see Trigger on-demand synchronization), this is autopopulated. If you created your own custom smart credential definition, you must complete this step. See Map a User Principal Name attribute for Smart Login.
7	Map a Security ID user attribute for Smart Login to Microsoft Windows. The Security ID is a value that uniquely identifies users in your Windows environment.	IDaaS smart credentials support encoding a Security ID value into certificates associated with a user's smart credentials. When using these smart credentials to perform Windows smart card login, this value in the certificate identifies the user in Windows. See Configure an on-premises Active directory.
8	Configure the Domain Controller to allow Smart Login.	Install Microsoft Certificate Services allows smart card login to domain clients.
9	Configure the Domain Controller to trust the Certificate Authority that issues the smart credential.	See Configure the Domain Controller to trust the issuing CA. Note: If the IDaaS Certificate Authority resides on the Domain Controller, then this step is not required.
10	Admin tasks: Configure computer login with mobile smart credentials through Bluetooth for Windows	For iOS devices only: Windows: Prepare Device Agent installation Windows: Install Device Agent Enable biometric login to Windows Configure the screen lock when smart credential is disconnected
11	Admin tasks: Configure computer login with mobile smart credentials through Bluetooth for Apple Macintosh	Mac: Prepare for Device Agent Installation Mac: Install Device Agent Associate a smart credential and a Mac user Configure the screen to lock when a smart credential is disconnected
12	Admin task (optional): Configure Windows clients protected by another Smart Credential to do Smart Login.	Configure Windows clients protected by another Credential Provider
13	Configure a resource rule to allow Smart Login	Create resource rules
14	User tasks to configure Smart Login	Configure a smart credential for biometric authentication Users add their own smart credential authenticator. See the section, Add and activate a mobile smart credential. Users activate their smart credential authenticator.
15	Test logging in with a smart credential authenticator (user experience)	Smart Login user experience