---
title: "Add a Smart Card Identity Provider in Okta"
slug: "add-smart-card-ip-okta"
updated: 2024-12-13T19:33:12Z
published: 2024-12-13T19:33:12Z
canonical: "docs.axiad.com/add-smart-card-ip-okta"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add a Smart Card Identity Provider in Okta

1. Open the Axiad Conductor welcome page for your tenant. Your URL looks like the following example, and is sent via email:  
http://crl.{tenantName}.{platform}.axiadids.net/welcome.html
2. In the **Resources** section, click **Root CA Certificate**  
The root.cer file downloads.
3. In the **Resources** section, click **Issuing CA Certificate**.  
The issuing.cer file downloads.
4. Sign into your Okta admin portal.
5. From the left menu, click **Settings** > **Features**.
6. Locate the **Smart Card Authenticator** feature, and enable it.  
TIPThis is a preview feature, but it is highly recommended that you enable it. This allows you to use/require smart cards (CBA) in authentication policies. It also allows smart cards to fulfill MFA requirements, including both **Phishing resistant** and **Hardware protected** requirements in authentication policies.
7. From the left menu, click **Security** > **Identity Providers**.
8. Click **+ Add identity provider**.
9. Click **Smart Card IdP**:  
![scr-okta-ip](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/scr-okta-ip.png)WARNINGIf **Smart Card IdP** is not available, contact Okta support and ask them to enable smart cards for your Okta tenant.
10. Click **Next**.
11. In the **Name** field, enter **Axiad Conductor CBA**.
12. Click **Browse...** next to the **Upload certificate chain files**.
13. Select the root.cer file you downloaded.
14. Click **+ Add Another**.
15. Click **Browse...**
16. Select the issuing.cer file you downloaded.
17. Click **Build certificate chain**.
18. Optionally, change the **Cache CRL for** setting to match your requirements.NOTEThis setting specifies the total amount of time Okta will consider the CRL valid after successful download. Okta will automatically attempt to download the latest CRL every hour in the background, but if the download fails for any reason you can still allow the cached CRL to be used for login attempts until it reaches the age specified here.  
  
The default value is 6 hours.
19. In the **IdP username** field, select **idpuser.subjectAltNameUpn**.
20. In the **Match against** field, select **Okta Username**.
21. In the **Security Characteristics** field, ensure **PIN protected** and **Hardware protected** are both selected.
22. Confirm the settings are correct.  
When finished with the entries, your screen should look like the following example:  
![scr-okta-config-smartcard](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/scr-okta-config-smartcard.png)
23. Click **Finish**.
24. From the left menu, click **Security > Authenticators**.
25. Click **Add authenticator**.
26. Find **Smart Card IdP** and click **Add**.
27. In the **Smart Card Identity Provider (IdP)** field, click the text box to show a drop-down list, and select the Smart Card IdP created in the previous steps.
28. Click **Add**.  
CBA authentication is now enabled. You can now configure your Okta Authentication policies to support/require Smart Card authentication.

TIPTo use CBA to sign into Okta, see Okta's official documentation: [Sign in with a Smart Card/PIV as an end user (okta.com)](https://help.okta.com/oie/en-us/Content/Topics/Security/idp-smart-card-end-user.htm).