Greetings again everyone. So, I've now got cacloginconfig.plist to map my CAC "Common Name" to dsattrtype:native:uid on the user account. With that, when a CAC is inserted into the client machine bound to my Open Directory system, it will ask for a PIN for the correct user. The problem is that it will not take the PIN. If I switch back to using pubkeyhash, then the PIN works, but kerberos doesn't, so the home folder doesn't mount. Any ideas? Thank you John