SCAWA: Enabling Smart Card Authentication for Web Applications

In the evolving landscape of digital security, the integration of robust Multi-Factor Authentication (MFA) methods stands as a critical defense mechanism against unauthorized access, augmenting traditional username and password approach. In this paper, we present SCAWA, a publicly available implementation for smart-card authentication in the context of web applications. Our proposal is based on NexU Github project implemented by Nowina Solutions, adapted to fit our specific needs. For developer convenience, we integrated our implementation into Keycloak, a popular open-source Identity-Management platform. In the paper we present solution’s architecture, implementation details and achieved results. Using SCAWA, developers can seamlessly integrate smart-card logon for their web applications, by only implementing a usual OAuth 2.0 flow. Through this contribution, we aim to lower the entry barrier for implementing sophisticated and secure authentication and authorization methods. Thereby, the result of our work aims to be fostering a more secure digital environment and enabling a higher adoption rate for secure authentication methods.