Get identities from a smart card in an authorization plugin

Hello,

I’m working on an authorization plugin which allows users to login and unlock their computer with various methods like a FIDO key. I need to add smart cards support to it. If I understand correctly, I need to construct a URLCredential object with the identity from the smart card and pass it to the completion handler of URLSessionDelegate.urlSession(_:didReceive:completionHandler:) method. I’ve read the documentation at Using Cryptographic Assets Stored on a Smart Card, TN3137: On Mac keychain APIs and implementations, and SecItem: Pitfalls and Best Practices and created a simple code that reads the identities from the keychain:

CFArrayRef identities = nil;

OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)@{
    (id)kSecClass: (id)kSecClassIdentity,
    (id)kSecMatchLimit: (id)kSecMatchLimitAll,
    (id)kSecReturnRef: @YES,
}, (CFTypeRef *)&identities);

if (status == errSecSuccess && identities) {
    os_log(OS_LOG_DEFAULT, "Found identities: %{public}ld\n", CFArrayGetCount(identities));
} else {
    os_log(OS_LOG_DEFAULT, "Error: %{public}ld\n", (long)status);
}

When I use this code in a simple demo app, it finds my Yubikey identities without problem. When I use it in my authorization plugin, it doesn’t find anything in system.login.console right and finds Yubikey in authenticate right only if I register my plugin as non-,privileged. I tried modifying the query in various ways, in particular by using SecKeychainCopyDomainSearchList with the domain kSecPreferencesDomainDynamic and adding it to the query as kSecMatchSearchList and trying other SecKeychain* methods, but ended up with nothing. I concluded that the identities from a smart card are being added to the data protection keychain rather than to a file based keychain and since I’m working in a privileged context, I won’t be able to get them. If this is indeed the case, could you please advise how to proceed? Thanks in advance.