Enable smart card support for sudo
Computer Configuration > Policies > Centrify Settings > Mac OS X Settings > Security & Privacy > Enable smart card support for sudo
This group policy configures sudo to require the smart card PIN for authentication instead of the user’s password. The user must be configured in the sudoers file and a smart card corresponding to the user must be presented at the time sudo is run.
If the smart card keychain is unlocked when sudo is run, sudo will not prompt for the PIN for authentication.