There a two scenarios in which it is needed:

* When an existing user logins for the first time with a smartcard
* When an existing user with an smartcard gets its certificate reissue