> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Smart Card Access

> Syteca smart card authentication: enforce PIV / CAC / domain-certificate sign-in to the Management Tool, so only users holding the physical card can administer the platform.

## Cryptographic authentication for the people who run your security platform

Password-based sign-in is the weakest link in any administrator workflow - phished, sprayed, reused, leaked. For a PAM and User Activity Monitoring platform, where the administrator can see and modify everything, password-only access is a meaningful risk.

Most security teams already know this and respond in one of two ways: layer 2FA on top of passwords (better, but TOTP secrets can still be phished in real time), or accept the residual risk and hope. **Syteca smart card authentication** is the third option - replace password sign-in with a **physical smart card** holding a domain-issued client certificate. Without the card, the Management Tool refuses to authenticate at the IIS layer, before sign-in even reaches the Syteca application. Phishing a smart card requires possessing the physical hardware *and* knowing the PIN.

<Info>
  **Use smart card access when you need to:**

  * Meet **PIV / CAC / FIPS 201** requirements for U.S. federal, defense, or contractor environments.
  * Enforce hardware-token authentication for administrators of a privileged-access platform.
  * Eliminate password-based sign-in to your monitoring and PAM consoles entirely, leaving no credential to phish.
  * Satisfy compliance frameworks (NIST 800-53 IA-2, ISO 27001 A.9.4) that require multi-factor for privileged systems.
  * Standardize on the smart cards your organization already issues for desktop login.

  **Pair it with [Two-Factor Authentication](/docs/administration/access/two-factor-authentication)** - smart cards control *access to the Management Tool URL*, while 2FA adds a TOTP step *inside* the sign-in flow. Some environments require both.
</Info>

<Warning>
  **Not available in SaaS.** Smart card authentication requires the on-premises Management Tool installed on a domain-member server, with IIS configured for Client Certificate Mapping. SaaS deployments use [Single Sign-On (SSO)](/docs/administration/integrations/keycloak-sso) instead.
</Warning>

This page walks through the prerequisites, the two stages of setup (IIS role + IIS configuration), and how sign-in works for the user. Set it up once and every subsequent sign-in is card-and-PIN.

## Prerequisites

The following are required before configuring smart card access:

* **A Domain Controller** with Active Directory.
* **A Certification Authority** to issue Client certificates.
* **Smart cards with enrolled Client certificates** from that Certification Authority - one per administrator who will sign in.
* **The Syteca Management Tool installed** on a Windows server that is a **member of the domain**.

After confirming the prerequisites, set up smart card access in two stages:

1. [Set up the Client Certificate Mapping Authentication role](#1-set-up-the-client-certificate-mapping-authentication-role) (turn on the IIS feature).
2. [Configure Client Certificate Mapping Authentication](#2-configure-client-certificate-mapping-authentication) (enable it on the Management Tool site).

## 1. Set up the Client Certificate Mapping Authentication role

This IIS feature handles the certificate validation. The setup steps depend on your Windows OS - pick the matching tab.

<Tabs>
  <Tab title="Windows 10 / 8 / 7">
    <Steps>
      <Step title="Open Programs and Features">
        Open Windows **Control Panel → Programs and Features**, then click **Turn Windows features on or off**.
      </Step>

      <Step title="Find and select the role">
        In the **Windows Features** tree, expand:

        **Internet Information Services → World Wide Web Services → Security**

        and select the **Client Certificate Mapping Authentication** checkbox.
      </Step>

      <Step title="Apply">
        Click **OK**, then **Close** when the change completes.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Windows Server 2012 / 2016">
    <Steps>
      <Step title="Open Server Manager">
        From the **Start** menu, open **Server Manager**.
      </Step>

      <Step title="Start Add Roles and Features">
        * **Windows Server 2016:** in the navigation pane select **Dashboard**, then click **Add roles and features**.
        * **Windows Server 2012:** open the **Manage** menu, then click **Add roles and features**.
      </Step>

      <Step title="Walk through the wizard">
        Click **Next** on the welcome page. On the **Installation Type** page, select the required installation type and click **Next**. On the **Server Selection** page, pick the destination server and click **Next**.
      </Step>

      <Step title="Select the Client Certificate Mapping role">
        On the **Server Roles** page, expand **Web Server (IIS) → Web Server → Security**, then select the **Client Certificate Mapping Authentication** checkbox. Click **Next**.
      </Step>

      <Step title="Install">
        On the **Features** page, click **Next**. On the **Confirmation** page, click **Install**. When the **Results** page shows success, click **Close**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## 2. Configure Client Certificate Mapping Authentication

With the role installed, enable it on the Management Tool site and require SSL.

<Steps>
  <Step title="Open IIS Manager">
    Open IIS Manager using the route for your OS:

    * **Windows Server 2012 / 2016** - Taskbar **Server Manager → Tools → Internet Information Services (IIS) Manager**.
    * **Windows 10** - **Windows+X → Control Panel → Administrative Tools → Internet Information Services (IIS) Manager**.
    * **Windows 7** - **Start → Control Panel → Administrative Tools → Internet Information Services (IIS) Manager**.

    <Tip>
      You can also press **Windows+R**, type `inetmgr`, and press **Enter** - works on any Windows version.
    </Tip>
  </Step>

  <Step title="Open Authentication for the server">
    In the **Connections** pane, click the server name. In the server's **Home** pane, double-click **Authentication**.
  </Step>

  <Step title="Enable AD Client Certificate Authentication">
    On the **Authentication** page, right-click **Active Directory Client Certificate Authentication** and select **Enable**.
  </Step>

  <Step title="Disable any other authentication types">
    If any other authentication types are enabled (Anonymous, Windows, Forms, etc.), right-click each one and select **Disable**. Smart card authentication should be the only enabled method.
  </Step>

  <Step title="Open SSL Settings for the Management Tool site">
    In the **Connections** pane, expand **Sites → Default Web Site**, then click the Management Tool website name (default: **Syteca**). In the **Home** pane, scroll to the **IIS** section and double-click **SSL Settings**.
  </Step>

  <Step title="Require SSL with a client certificate">
    On the **SSL Settings** page:

    * Select the **Require SSL** checkbox.
    * In the **Client certificates** section, select the **Require** option.

    Click **Apply** in the **Actions** pane.
  </Step>
</Steps>

Smart card authentication is now active. The Management Tool will only accept connections from clients presenting a valid certificate from the domain.

## Sign in using a smart card

<Frame caption="The Management Tool sign-in screen with the smart card option enabled - users select a certificate from their smart card instead of entering a password.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/access/smart-card-signin.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=71c5c84ac4616662af8111e3c6d210c5" alt="Management Tool login screen showing the smart card sign-in option alongside the standard username and password fields" width="388" height="225" data-path="images/administration/access/smart-card-signin.png" />
</Frame>

Once smart card access is configured, every sign-in to the Management Tool requires the physical card.

<Steps>
  <Step title="Insert the smart card">
    Insert the smart card into the computer where you're signing in.
  </Step>

  <Step title="Open the Management Tool URL">
    In your browser, go to `https://<computer-name-or-ip>/<URL-folder>` - for example, `https://john-pc/Syteca`.
  </Step>

  <Step title="Enter the smart card PIN">
    In the **Windows Security** window, enter the smart card PIN, then click **OK**.
  </Step>

  <Step title="Sign in to the Management Tool">
    The Management Tool sign-in page opens. Enter the credentials of an existing user - internal or Active Directory - as on a normal [sign-in](/docs/get-started/management-tool-basics#open-and-sign-in).

    <Warning>
      If the user doesn't have a domain certificate, or the certificate doesn't match the smart card, the browser displays an error and the Management Tool sign-in page never loads.
    </Warning>
  </Step>
</Steps>

## Related

<CardGroup cols={2}>
  <Card title="Two-factor authentication" icon="smartphone" href="/docs/administration/access/two-factor-authentication">
    TOTP-based 2FA - can be combined with smart cards or used standalone.
  </Card>

  <Card title="Keycloak SSO integration" icon="user-check" href="/docs/administration/integrations/keycloak-sso">
    Single Sign-On - an alternative authentication strategy.
  </Card>

  <Card title="Management Tool basics" icon="layout-dashboard" href="/docs/get-started/management-tool-basics">
    The standard sign-in flow that smart cards augment.
  </Card>

  <Card title="Management Tool prerequisites" icon="list-checks" href="/docs/administration/deployment/management-tool-prerequisites">
    Pre-install setup, including the HTTPS certificate this builds on.
  </Card>
</CardGroup>