All,

I am supporting a large install base of users (roughly 1000 users for 2000 computers) with: 

Identiv SCR3500 A Contact Reader

Product ID: 0x5814

Vendor ID: 0x04e6 (Shuttle Technology) 

Version: 2.02

Which are nearly physically identical to 

SMC Microsystems SCx35xx v2.0 USB SC Reader

Product ID: 0x5410

Vendor ID: 0x04e6 (Shuttle Technology)

Version: 3.04

In OS X 10.7 -> OS X 10.10 the SCx35xx automatically works, the SCR3500 needs a “driver” ( http://support.identive-group.com/show_faq.php?f_kz=1065&lang=EN##) which adds a new bundle at /usr/libexec/SmartCardServices/Drivers/smccid.bundle

[ “by works” I mean in /var/logsystem.log the OS will log the insertion/removal of a reader. Be assured that I am not troubleshooting card/user/certificate issues here. ]

Alternatively, you can use the provided script in that FAQ article to modify the existing ifs-ccid.bundle.

Therefore, as far as I understand it these are functionally identical, and the issue is properly identifying the card reader to the OS so drivers that already exist can do their job

In order to be able to support upgrades to OS X 10.11, I will need to provide support for these card readers.

Due to /usr/libexec being off limits to SIP, i see the following options:

1. When I create a new OS X 10.11 image, temporarily disable SIP during creation to place the drivers. Should I have a later “driver” conflict I will need to disable SIP to remove the smccid.bundle, which presents challenges at this scale.
2. Ask the developers of smartcardservices if a new release will support these card readers (and I have delayed close as I can to the release of OS X 10.11 so that I can say its “Sept 30th somewhere.”
3. Ask the developers if there is a better way to reference a non-SIP location for a driver (for instance, with 10.11 lacking pcscd (or at the very least, which pcscd coming up with nothing), is /etc/reader.conf still honored? In which case I simply need to identify the right CHANNELID and i can place the driver at /usr/local/pcsc/drivers/smccid.bundle) or a writeable location somewhere in /Library/ that smart card services already looks for drivers
4. File a bug report to Apple, asking for /usr/libexec/smartcardservices/drivers to be exempted from SIP (I am aware that this strays into unsupported territory and I will be correspondingly courteous and understanding.)

I will be prepared for 1, and this email is asking politely for 2 or 3. I’ll pursue 4 if warranted.

-- 
 Dr. Ludovic Rousseau