Add a Smart Card identity provider

Enter a name for the IdP. End users see this name when they sign in.

Upload certificate files to build your certificate chain. The files must be in .pem or .der format.

Upload all the files and click Build certificate chain. The chain and its certificates appear.

Click Reset certificate chain to replace the current chain with a new one.

Select the security characteristics associated with this Smart Card IdP: PIN protected, Hardware protected.

Okta uses these characteristics to determine how this IdP is prompted for users in policies.

Select a Smart Card attribute from the dropdown menu to use as the IdP username. You can also define a custom username using Okta Expression Language. See Smart Card idpUser expressions and Expressions.

Select an Okta attribute from the dropdown menu. The IdP username is matched against this value to find an existing user account in Okta.

Optional. Select the checkbox if you want to allow matching the IdP username with multiple identities that meet the Match against criteria. This allows your end users to use one Smart Card for different identities and authenticate into corresponding accounts.

Select what to do if no matching user account is found in Okta during enrollment when the Smart Card authenticator is configured.

• Deny enrollment: The end user isn't allowed to enroll. This is the most secure option.
• Assign Smart Card to the user: Assign the Smart Card to the current user.

The following restrictions apply when you select the option to assign the Smart Card to the user:

• Use a PIN-protected Smart Card.
• The following profile attributes can't be updated during enrollment:
  • Username
  • Primary email
  • Secondary email
  • Any custom attributes that are used as multiple identifiers
• If a matching or mapping attribute is restricted, the enrollment request is denied.
• Be aware of the risk of unauthorized profile updates, where a user attempts to enroll with a Smart Card and PIN that belongs to another user.

The Smart Card is enrolled for the current user and all attribute values are updated from the Smart Card values.

Select what to do if no matching user account is found in Okta during sign-in attempt.

• Redirect to Okta sign-in page: The end user is redirected to the Okta sign-in page.
• Create new user (JIT): Okta creates a new Active user in Universal Directory. Specify how to create the Just in Time (JIT) account in JIT settings.

Update attributes for existing users: Update the existing user profile with the corresponding mapping attributes retrieved from the Smart Card.

The following restrictions apply:

• Profile attribute updates require the If no match is found during sign-in setting to be Create new user (JIT).
• The following profile attributes can't be updated:
  • Username
  • Primary email
  • Secondary email
  • Any custom attributes that are used as multiple identifiers.
• If any mapping attribute is restricted, the profile isn't updated.
• If multiple users match the criteria, the profile isn't updated.

Map the Smart Card attributes to the user profile attributes that are required in Okta. The default required Okta user profile attributes are login, first name, last name, and email. However, depending on your configuration there may be more required profile attributes.

The Smart Card attribute you've selected for IdP username is mapped to the login attribute in Universal Directory when creating a JIT user. In the Profile Editor mappings, ensure the value mapped to the login attribute conforms to your username requirements.

Click Edit profile and mappings to map the values in the Profile Editor. See Map profile attributes.

Optional. In addition to the Okta-required values, you can specify more certificate values required to create the JIT account. Certificates without these values are denied access.

Select a Smart Card attribute from the dropdown menu and specify a corresponding required certificate value. You can also define a custom value using Okta Expression Language.

If you require more attributes, select if all or any of them are required to create the JIT account.