| Description | This article describes how to allow Smartcard PIN authentication using FortiAuthenticator agent version 4.x. |
| Scope | FortiAuthenticator Agent, Windows 10 & Windows 11. |
| Solution |
In this case, FortiAuthenticator Agent 4.x is installed on Windows 10 or Windows 11.
Disable 'Permit Build-In Password providers' under 'Credential Provider Options' in FortiAuthenticator Agent settings. This setting works fine for login into Windows directly or via a remote desktop session.
'Disabling built-in password providers removes the Microsoft default logon mechanism, which precludes any user from being able to log in in the event that the FortiAuthenticator Agent malfunctions or prevents access to the system (possibly even in safe mode). We recommend having at least one exempt user with administrative access to allow you to bypass the FortiAuthenticator Agent in such situations.'
Now, in the case there is another application or website that requires a smart card or physical token authentication.
The following pop-up window will appear without showing an option to enter credentials.
In this scenario, it is necessary to make some entries in the Windows registry to allow the Windows pop-up to present an option to enter credentials.
On Windows 10 and Windows 11 Machines
Go to Windows registry and add the following entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FAC_Agent_v1.0\
{1b283861-754f-4022-ad47-a5eaaa618894}{C885AA15-1764-4293-B82A-0586ADD46B35}
{1b283861-754f-4022-ad47-a5eaaa618894},{C885AA15-1764-4293-B82A-0586ADD46B35}
If it does not work then, proceed as below:
Go to Windows registry and add the following entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FAC_Agent_v1.0\
{94596c7e-3744-41ce-893e-bbf09122f76a}
Otherwise, modify an existing 'CredentialProvidersWhiteList' STRING 'sz' and replace the existing entries with the value given above.
After creating the entry mentioned above, now when trying to access any website that requires smart card authentication or PIN access then the pop-up Window will be shown and prompt to enter credentials.
Related document: |
