Diagnosing smart card log in problems

Two general methods for diagnosing smart card log in problems are provided:

  • By using the sctool utility as described in the sctool man page.
  • By performing the diagnostic procedures described in this section.

The following procedures are intended to diagnose multiple causes of smart card log in failure. It is recommended that you retest smart card login at regular intervals (such as after each step) as you perform this procedure.

 

  1. Ensure that macOS built-in PIV token is not disabled.

    % defaults read /Library/Preferences/com.apple.security.smartcard DisabledTokens

    It should not exist.

  2. Ensure that smart card support is enabled.

    % sctool -s

    It should show that smart card support is enabled.

  3. Ensure that the smart card can be recognized by MacOS.

    % sc_auth identities

    It should show your card and the card has been paired to the Active Directory user.

  4. Collect support information.

    % sctool -S

    Send the file /tmp/sctool.support to Centrify Support.