SmartCard
com.apple.security.smartcard
The payload that configures a smart card.
Not available with User Enrollment · Only one instance per profile · macOS: device channel only
Configuration Keys (7)
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
allowSmartCardbooleanAllow SmartCard | boolean | If 'false', the system disables smart cards for logins, authorizations, and screen saver unlocking. It's still allowed for other functions, such as signing emails and accessing the web. The device requires a restart for a setting change to take effect. | Default: true | Range: — |
allowUnmappedUsersintegerAllow Unmapped Users | integer | If set to integer 1, allows users who aren't paired with a smart card to log in with password. | Default: — | Range: Disallow (0), Allow (1) |
UserPairingbooleanUser Pairing | boolean | If 'false', users don't get the pairing dialog, although existing pairings still work. | Default: true | Range: — |
oneCardPerUserbooleanRestrict One Card Per User | boolean | If 'true', a user can pair with only one smart card, although existing pairings are allowed if already set up. | Default: false | Range: — |
checkCertificateTrustintegerCertificate Trust Validation | integer | Configures the certificate trust check and has one of the following possible values: '0': Turns off certificate trust check. '1': Turns on certificate trust check. The device performs a standard validity check but doesn't include additional revocation checks. '2': Turns on certificate trust check. The device also performs a soft revocation check. Until CRL/OCSP explicitly rejects the certificate, the device considers it valid. This setting means that unavailable or unreachable CRL/OCSP allow this check to succeed. '3': Turns on certificate trust check. The device also performs a hard revocation check. Unless CRL/OCSP explicitly says "This certificate is OK," the device considers it invalid. This option is the most secure. | Default: 0 | Range: Off (0), On (1), On & revocation check is set to the soft level (2), On & revocation check is set to the hard level (3) |
| boolean | If 'true', a user can only log in or authenticate with a smart card. | Default: false | Range: — | |
| integer | If '1', the device enables the screen saver when the user removes the smart card. | Default: 0 | Range: 0, 1 |