Enrolling devices by using derived credentials 编辑

Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification (PIV) card or Common Access Card (CAC).

The derived credentials are an enrollment certificate that contains the user identifier, such as UPN. Endpoint Management stores the credentials obtained from the credential provider in a secure vault on the device.

Endpoint Management can use derived credentials for iOS device enrollment. If configured for derived credentials, Endpoint Management doesn’t support enrollment invitations or other enrollment modes for iOS devices. However, you can use the same Endpoint Management server to enroll Android devices through enrollment invitations and other enrollment modes.

Device enrollment steps when using derived credentials

Enrollment requires that users insert their smart card to a reader attached to their desktop.

1. The user installs Secure Hub and the app from your derived credential provider. In this example, the identity provider app is the Intercede MyID Identity Agent.

   

2. The user starts Secure Hub. When prompted, the user types the Endpoint Management fully qualified domain name (FQDN) and then clicks Next. Enrollment in Secure Hub starts. If Endpoint Management supports derived credentials, Secure Hub prompts the user to create a Citrix PIN.

   

   

   

3. The user follows the instructions to activate their smart credential. A splash screen appears, followed by a prompt to scan a QR code.

   

4. The user inserts their card into the smart card reader that’s attached to their desktop. The desktop app then displays a QR code and prompts the user to scan the code using their mobile device.

   

   The user enters their Secure Hub PIN when prompted.

   

After authenticating the PIN, Secure Hub downloads the certificates. The user then follows the prompts to complete enrollment.

To view device information in the Endpoint Management console, do one of the following:

• Go to Manage > Devices and then select a device to display a command box. Click Show more.
• Go to Analyze > Dashboard.