FreeIPA already supports Smart Card authentication: the user provides a Smart Card containing a certificate and the user lookup is performed with a binary match of the whole certificate (see User Certificates).

The goal is to extend this feature to support the following cases:

• the Smart Card contains multiple certificates. The administrator must be able to define Matching rules that will check which certificates are valid for authentication.
• the Smart Card contains multiple certificates that are valid for authentication. The user must be able to select the certificate he wants to use for login.
• the Certificate presented by the user is mapped to multiple accounts. The user must be able to disambiguate by providing a username.
• the mapping between a Certificate and a user account can be done either through binary match of the whole certificate or a match on custom certificate attributes (such as Subject + Issuer).