1.3. The pros and cons of using certificates to authenticate users in IdM

The advantages of using certificates to authenticate users in IdM include the following points:

A PIN that protects the private key on a smart card is typically less complex and easier to remember than a regular password.
Depending on the device, a private key stored on a smart card cannot be exported. This provides additional security.
Smart cards can make logout automatic: IdM can be configured to log out users when they remove the smart card from the reader.
Stealing the private key requires actual physical access to a smart card, making smart cards secure against hacking attacks.
Smart card authentication is an example of two-factor authentication: it requires both something you have (the card) and something you know (the PIN).
Smart cards are more flexible than passwords because they provide the keys that can be used for other purposes, such as encrypting email.
Using smart cards use on shared machines that are IdM clients does not typically pose additional configuration problems for system administrators. In fact, smart card authentication is an ideal choice for shared machines.

The disadvantages of using certificates to authenticate users in IdM include the following points:

Users might lose or forget to bring their smart card or certificate and be effectively locked out.
Mistyping a PIN multiple times might result in a card becoming locked.
There is generally an intermediate step between request and authorization by some sort of security officer or approver. In IdM, the security officer or administrator must run the ipa cert-request command.
Smart cards and readers tend to be vendor and driver specific: although a lot of readers can be used for different cards, a smart card of a specific vendor might not work in the reader of another vendor or in the type of a reader for which it was not designed.
Certificates and smart cards have a steep learning curve for administrators.