diff --git a/app/controllers/registrant/sessions_controller.rb b/app/controllers/registrant/sessions_controller.rb
index c7c02a5a5..472035ca0 100644
--- a/app/controllers/registrant/sessions_controller.rb
+++ b/app/controllers/registrant/sessions_controller.rb
@@ -46,10 +46,14 @@ class Registrant::SessionsController < ::SessionsController
   # rubocop:enable Metrics/PerceivedComplexity
 
   def id
-    logger.error request.env.inspect
-    # @user = RegistrantUser.where(identity_code: 'EE-123').first_or_create
-    # sign_in(@user, event: :authentication)
-    redirect_to registrant_root_url
+    @user = RegistrantUser.find_or_create_by_idc_data(request.env['SSL_CLIENT_S_DN'])
+    if @user
+      sign_in(@user, event: :authentication)
+      redirect_to registrant_root_url
+    else
+      flash[:alert] = t('login_failed_check_id_card')
+      redirect_to registrant_login_url
+    end
   end
 
   def login_mid
diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb
index dfb66705c..d73f1eca5 100644
--- a/app/models/registrant_user.rb
+++ b/app/models/registrant_user.rb
@@ -1,8 +1,22 @@
 class RegistrantUser < User
-  attr_accessor :registrar_typeahead
+  attr_accessor :idc_data
 
   def ability
     @ability ||= Ability.new(self)
   end
   delegate :can?, :cannot?, to: :ability
+
+  def to_s
+    registrant_ident
+  end
+
+  class << self
+    def find_or_create_by_idc_data(idc_data)
+      return false if idc_data.blank?
+      identity_code = idc_data.scan(/serialNumber=(\d+)/).flatten.first
+      country = idc_data.scan(/^\/C=(.{2})/).flatten.first
+
+      where(registrant_ident: "#{country}-#{identity_code}").first_or_create
+    end
+  end
 end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 1da48fa9f..bcab7ee6c 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -767,3 +767,4 @@ en:
   object_status_prohibits_operation: 'Object status prohibits operation'
   domain_registrant_update_subject: "Kinnitustaotlus domeeni %{name} registreerija vahetuseks / Application for approval for registrant chache of %{name}"
   whois: WHOIS
+  login_failed_check_id_card: 'Log in failed, check ID card'