id: auth_smartcard_allow
title: Allow Smartcard Authentication
discussion: |
  Smartcard authentication _MUST_ be allowed.

  The use of smartcard credentials facilitates standardization and reduces the risk of unauthorized access.

  When enabled, the smartcard can be used for login, authorization, and screen saver unlocking.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\
  .objectForKey('allowSmartCard').js
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-95135-0
  cci:
    - CCI-000187
    - CCI-000765
    - CCI-000766
    - CCI-000767
    - CCI-000768
    - CCI-001941
    - CCI-001953
  800-53r5:
    - IA-2(1)
    - IA-2(2)
    - IA-2(12)
  800-53r4:
    - IA-2(12)
    - IA-5(11)
  srg:
    - SRG-OS-000107-GPOS-00054
    - SRG-OS-000112-GPOS-00057
    - SRG-OS-000108-GPOS-00055
    - SRG-OS-000106-GPOS-00053
    - SRG-OS-000376-GPOS-00161
    - SRG-OS-000105-GPOS-00052
    - SRG-OS-000068-GPOS-00036
  disa_stig:
    - APPL-26-003030
  cis:
    benchmark:
      - N/A
    controls v8:
      - 6.3
      - 6.4
      - 6.5
  cmmc:
    - IA.L1-3.5.1
    - IA.L1-3.5.2
    - IA.L2-3.5.3
  800-171r3:
    - 03.05.03
macOS:
  - '26.0'
tags:
  - 800-171
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.security.smartcard:
    allowSmartCard: true
