Smart Cards (CAC / PIV)

The Companion Agent drives smart-card infrastructure so credentialed users can authenticate and sign with their CAC (Common Access Card) or PIV (Personal Identity Verification) card. Cards are accessed through the platform's native middleware and the standard PKCS#11 interface.

Supported credentials

Credential	Use
PIV authentication	Phishing-resistant sign-in to the IdP and the Agent.
PIV / CAC signature	Cryptographic document signatures bound to the cardholder.
PIV key management	Decryption key operations for compartmented content.

Middleware

Platform	Path
Windows	Smart Card minidriver + Windows Hello for Business.
macOS	CryptoTokenKit + system smart-card services.
Linux	OpenSC / vendor PKCS#11 module via the system token service.

The Agent auto-detects an inserted card, reads its certificates, and exposes a selection prompt when more than one credential is available.

PINs never touch the Agent's storage

Card PINs are entered through the OS secure prompt and verified by the card itself. The Agent requests cryptographic operations from the card; it never stores or sees the PIN.

Authentication flow

The user inserts their CAC/PIV card.
The Agent reads the authentication certificate and initiates a challenge-response with the card via PKCS#11.
On success, the card-backed identity is bound into the session and reflected in subsequent assertions.

text

Card inserted ─▶ Agent reads cert ─▶ PKCS#11 challenge ─▶ PIN (OS prompt)              ─▶ card signs challenge ─▶ session established

Signing

When a workflow requires a cardholder signature, the Agent routes the signing request to the card. The private key never leaves the card; only the resulting signature is returned.

bash

# A signing request is brokered locally and fulfilled by the cardcurl -X POST http://127.0.0.1:7843/v1/access/evaluate \  -H "Origin: https://viewer.osdfsystems.com" \  -H "Content-Type: application/json" \  -d '{ "doc_id": "01J9…", "action": "sign", "credential": "piv" }'

Removal behavior

Card removal can be configured to immediately move the Agent to the Locked state and revoke active leases, enforcing presence for sensitive sessions.

Continue to enterprise deployment to roll the Agent out across managed fleets.