All versions of Centrify DirectControl on Mac OS XQuestion:
Can smart cards be used to unlock Mac systems encrypted with FileVault 2?Answer:
FileVault 2 is not compatible with smart card authentication.
The only types of accounts that can unlock FileVault 2 are:
- Local user accounts
- Network accounts that are converted into Mobile Accounts.
This is a restriction in the EFI, which only Apple has control of. Please see the following Apple white paper for more information:
- This restriction only affects the unlocking portion of FileVault at boot-time - Smart card authentication can still be used after the Mac has been unlocked - this means that a restricted local account could be created solely for unlocking the FileVault login screen, after which the smart card user can login as normal at the standard login screen.
- On OS X 10.8 and below, FileVault 2 is designed to automatically log the user straight into their Desktop session after unlocking FileVault. This means the "unlocking account" will need to logout to get to the login screen after unlocking the disk:
- On OS X 10.9, Apple introduced the ability to disable this behaviour and let the authorised user to only unlock the FileVault and then go straight to the login screen:
- For steps on setting up FileVault with Centrify group policies, see:
(All external links provided as a courtesy)