With CodeB SmartLogin an employee’s access card can live in the CodeB Wallet app (myEUID) on an Android phone instead of, or beside, a plastic card. At a Windows PC with a normal NFC reader the employee opens the card in the app, unlocks the phone and holds it on the reader — CodeB logs on or unlocks Windows exactly as with a plastic NFC card, including card tokens, cards in Active Directory, shared accounts and the logon audit.
Logging on to Windows with the phone instead of an NFC card
The phone-as-logon-card feature lets an Android phone running the CodeB Wallet stand in for a plastic NFC access card at the Windows logon screen. The employee opens the card in the app (“Use at reader”), unlocks the phone and taps it on a standard NFC reader; the CodeB SmartLogin tile logs the user on or unlocks the session.
Everything that works with a plastic card works with the phone: card tokens, cards stored in Active Directory, several cards (and phones) for one shared account, the logon audit (events 1100/1101 record the phone card’s ID), and CodeBAdminCLI /updatecards.
This page covers the phone as a CodeB NFC card through the CodeB tile. If you want passwordless logon with no CodeB software on the PC, see the phone as a PKI smart card instead.
Why is it secure?
- No fixed number is sent. For every tap the PC sends a new random challenge and the phone signs it with a key that never leaves the phone’s secure hardware (StrongBox / TEE).
- Issuer-signed card data. The card data is signed by the issuer (CodeB), with the chain up to the
CodeB IACA phone.codeb.iocertificate. The PC checks the whole chain offline — no internet is needed at the moment of logon. - Deliberate, fresh presentation. The phone must be unlocked, and the card must have been chosen in the app within the last 60 seconds.
- Pseudonymous. The PC only learns a pseudonymous card ID — never the employee’s name or other personal data.
- Standards. ISO/IEC 18013-5 data (mdoc), ECDSA P-256 signatures, and FIPS 140-2 approved algorithms on the PC.
How do you set it up?
- Issue the access card to the employee’s phone on the CodeB admin page (
phone.codeb.io, “NFC access cards”). The card must contain the site ID of the PCs (for examplewindows-logonor the customer’s site name). - On the PCs set the registry values below under
HKLM\SOFTWARE\WOW6432Node\CodeB\CAP1(REG_SZ, best delivered by a Group Policy preference).SiteIdis required; without it phone sign-in is off. - Link the phone card to the Windows account exactly like a plastic card: tap the phone in the CodeB card tool (
LinkNFCCard) or useCodeBAdminCLI /add2fs//add2adwith the card ID that the tool shows. The PC used for linking needs the sameSiteId. - Done. The employee taps the phone at the logon screen.
Which registry values does the phone card need?
All values are REG_SZ under HKLM\SOFTWARE\WOW6432Node\CodeB\CAP1. See the full registry reference.
| Value | Meaning |
|---|---|
SiteId | Required. The site ID the card was issued for. Without it the phone sign-in is off. |
RequiredGroup | Optional access group the card must have (for example windows-logon). |
MaxStatusAgeDays | Optional, default 7: how old the newest revocation list may be (for offline laptops). |
ReaderId | Optional name of the PC sent to the phone (default: the computer name); shows up in the phone’s history. |
A customer with its own issuing certificate can add its IACA certificate as a .pem/.cer file to C:\ProgramData\CodeB\CAP1\ — only files that ordinary users cannot change are used. Set DisableBuiltInIaca = 1 to trust only those files.
Linking the phone to a Windows account
A phone card is linked exactly like a plastic NFC card. Tap the phone in LinkNFCCard and read the card ID, or script it with CodeBAdminCLI /add2fs (card token) or /add2ad (store in Active Directory) using that ID. Because a phone card can be linked to a shared account alongside other cards and phones, see shared accounts with several cards for shift-work setups, and linking tokens for the full linker reference.
Offline use and revocation
- Without internet: logon works offline. Only the revocation list needs an update now and then (by default at least every 7 days, see
MaxStatusAgeDays). - Lost phone: revoke the card on the CodeB admin page and issue a new one. The PCs refuse the revoked card as soon as they have the new revocation list (they fetch it in the background; laptops work offline for up to 7 days by default). The new card has a new ID, so link it to the account again.
The CodeB Wallet is available for Android phones with NFC. The phone must be unlocked. Revocation reaches an offline PC only once that PC has fetched the new revocation list.
Troubleshooting
Nothing happens when I tap the phone
Open the card in the CodeB Wallet (“Use at reader”) and tap within 60 seconds; the phone must be unlocked.
The phone card is refused
Check that the PC’s SiteId matches the site the card was issued for, that any RequiredGroup is present on the card, and that the PC’s revocation list is current (within MaxStatusAgeDays).
Frequently asked questions
Which phones can be used?
Android phones with NFC and the CodeB Wallet app. The app is currently available for Android.
Which readers work?
The same PC/SC NFC readers as for plastic cards.
Does phone logon work without internet?
Yes. The logon is checked offline; only the revocation list needs an update now and then (default at least every 7 days).
What happens to the audit with a phone?
The CodeB logon audit works as with a card: events 1100 (success) and 1101 (failure) record the phone card’s pseudonymous ID, the account and the PC. See logon audit events.