Administrator manual
- Introduction to the guide
- Ironchip management panel
- First steps
- Applications
- Users
- Keys
- Secure areas
- Key groups
- Synchronisation
Introduction to the Guide
This guide provides a detailed description of the use of the Ironchip Identity service;
We will provide details for the correct use of our platform. This guide facilitates the handling of the functions allowing the mastery of all the features offered by our service, in addition we will show the steps to follow in the tasks to be performed in order to provide the user with a tool that ensures the security of accesses and companies through a good and easy daily experience;
Ironchip Management Panel
When accessing the Ironchip platform, you will find the company management panel under the "Get Started" tab. Through this panel, you can perform various functions such as managing user access to the services you desire, as well as adding and removing these users, among other functions.
Access to the Management Panel
The Ironchip Management Panel is a fundamental tool for administering and managing all aspects related to security and user access on the platform.
To access the Management Panel, first go to the website through this link: https://app.ironchip.com/
Once on the main page, enter the email address you used for registration, i.e., enter your credentials into the Ironchip Management Panel, and initiate an authentication process.
First Steps
Upon entering the management panel, you will find a basic guide to all the main functions that can be performed. These first steps include creating a new application, setting up account recovery, adding new users, synchronizing users, managing safe zones, and updating billing information.
By clicking the buttons on the right, you directly access the selected section to perform the operation.
Below each button, you'll find a link to access the documentation for each section.
Applications
Add User to an Application
To add a user to a service, start from the "Applications" section. Here, you will select the service to which you want to add one or more users or groups. Once on the application information page, you can view data such as the count of successful and unsuccessful authentications to access the application, as well as a list of all groups that have already been granted access.
If you want to grant new access to one of the applications, you just have to enter it and click on the "Add Access" button.
Upon clicking it, a new window will appear with the 5 steps of the process. The first step will be to select the user group(s) to which you want to grant access to the application. For this, we have a list of the groups created so far in the company. To select the desired group(s), simply check the box located to the left of the name of each group. Click the "Continue" button to proceed to the next step of the process.
In the next tab, you will proceed to choose the format of the username (External Username) that all users being added to the application will have. By default, Email will be selected. However, there are a series of tags (such as name, surname, domain, etc.) that will allow you to construct the format that best fits your requirements. To access them, you need to click in the area where it says "Enter a tag". The tag composer assigns a different "external username" to each user, however, if a static template is used, the same template is applied to all.
After choosing the desired format, click the "Continue" button.
Note: In case of doubts, you have a help block located at the back of the example. Click on "Need help" to access it.
The next step will be to select the "Key tags" to assign to the chosen group. You will have the option to choose combinations of key tags by selecting more than one key tag on the same line.
The difference between AND and OR is that with AND, both conditions must be met, whereas with OR, the fulfillment is partial, meaning one or the other can be fulfilled.
To distinguish between each option of key tags, click the "+" button and choose the desired key tag in the following field. If you doubt your selection during the process, you can use the "x" button located to the left of the field to remove that key tag.
Once you have selected the desired key tag(s) or combination(s), click the "Continue" button.
In the next window, you will see a summary of all the data you have selected in the previous steps. After carefully reviewing them, click the "Finish" button to start the access creation process.
A few seconds later, if everything goes correctly, you will see the access we have added on the main screen. This access can be managed at any time by clicking the "Options" button.
If you click the "Options" button, three options will be displayed:
1. Access Conditions: By clicking here, you will see a summary of the access rules configured for that access. To exit this window, click the "Close" button.
2. Configure Access: By clicking here, you can modify the access from step 2 (user name composition). 
3. Delete Access: Clicking here will permanently delete the access.
Users
In the user section, all registered users on the platform can be managed. From here, administrators can add new users, assign roles and permissions, and manage account protection.
User synchronization is a process that allows adding or updating users in the Ironchip platform automatically.
This is especially useful when there is a large number of users, and you want to keep the platform's database updated.
Add User to the Company
Within the "Directory" section, under the "Users" subsection, you can see all the users belonging to the company.
To add a new user, you should click on the "New User" button.
1. Management Panel. Directory tab.
When you click on the "New User" button, a new window will open where you'll need to enter the details of the new user, specifically: first name, last name, email address, and preferred language.
You'll also see a checkbox labeled "Enable Ironchip" to mark if you want to register this user in Ironchip. If you don't check this box, the user would be created, but they wouldn't receive any Ironchip email to register, and a red crossed-out shield would appear in the protection section, indicating that the registration process is incomplete. This checkbox is usually left unchecked for LDAP synchronization purposes.
2. Once you have filled in the fields in the image above, click on "Add User" (bottom right corner).
The user will need a prior verification to be definitively and correctly registered. The verification consists of carrying out the registration process correctly and reliably. For this, the new user will receive a QR code in their email, which they will need to scan to be securely registered on the platform.
While the user has not completed their verification, the "Protection" column in the "Users" panel will display a red shield icon. The orange color will be seen when "Enable Ironchip" has been clicked when adding the user, and the user has received the email but has not yet verified.
If the user has previously completed the verification process correctly, the "Protection" column in the "Users" panel will display a green shield icon. This means that the registration has been completed correctly, the user has been verified, and the registration process has concluded.
In the list of users, several properties are observed:
- The email address used for registration.
- The role. There are three different types:
- Administrator: User with access to the "Ironchip Management Panel" service.
- User: Verified user without access to the "Ironchip Management Panel" service.
- Guest: Unverified user.
- Protection: Used to determine the account's status if it is registered in Ironchip or not.
- Options: Clicking on the dropdown will provide a list of options, which will be:
- Add a device.
- Configure recovery.
- Promote user if not an administrator, and demote if already an administrator and you want to make them a regular user.
- Delete user. 
Administrator
To create an administrator, they must first exist as a user. If they are not already a user, access the Users section.
To add a new administrator to the platform, go to the Users tab in the "Directory" folder. Once the user is added and verified, select "Options" and from the dropdown, click on "Promote User".
Device Management
To register a device, there are two ways to do it, but first, you must understand the differences between them. If you want to register a new device or a new user, you must follow the process we explain below for "Registering a Device".
However, if you want to recover your account from a previously registered device, you will have to access your account through the recovery process that we will explain later. This is because you cannot re-register a device that is already registered.
In the device management section, you can register or unregister, and recover devices associated with users. This is especially useful in case of loss or theft of a device, as it allows you to deactivate access from that device and recover the account on another device.
Registering a Device
1. Click on "Add a device".
You will see this message, click on "Add device" again, and the corresponding user will receive an email to add a device.
Unregistering a Device
In this case, if you want to unregister a device, you would simply need to click on the name of the user you want to manage, and in the "Key list" section, you will see the safe zones and devices of the user. To unregister a device or delete a safe zone, you just need to click on the trash can icon. The last device cannot be deleted; you must always have at least one associated device.
At the bottom, you will see what accesses that user has.
Device Recovery
As mentioned earlier, you should access the device recovery process when you want to recover your account from an existing and registered device.
In this case, imagine that a user has lost access to the platform and wants to recover it. To do this, they need to go to "Directory," access the "Users" section, and search for the corresponding user. Once found, they should click on "Options" and then on "Configure recovery."
Now, you should choose the device that the user wants to recover access to.
Once this is done, you need to click on "Send recovery."
After this, the user will receive a recovery email.
Account Recovery
To recover a user account, you should set up recovery using the "Configure recovery" button. Once in the configuration modal, select the desired device and save the settings. After completing the previous steps, use the "Send recovery" button to send the recovery email to the target user. 
Both buttons can be found in "Directory" > "Users" > "Options".
If the application already has an active session, you can delete it by clearing the application data. Finally, after receiving the email, the user can follow the same process as when registering to recover the device.
Groups
In this section, you will find information about the different groups added to the company so far.
There will always be a group called "All users," which will be a group where all users registered on the platform will be added, and this group cannot be modified or deleted. Another group you will always see is the "Administrators" group, which can be modified but not deleted.
At the top right, you will find a "New Group" button. Clicking on it will display a window where the first thing you will need to do is add the group name and click the "Continue" button.
Now you will be able to see the added group on the main screen along with the rest of the groups. The user counter will be at 0, and to add users to this group, you should click the "Manage group" button.
A window will appear with the name of the group to be edited. Next, you will see two tabs, one with the users who already have access to this group, and another with the users who do not yet have access.
If you click on the tab of users without access, a list will be displayed with all the users and their corresponding email. You can choose the users you want by clicking on the checkbox to the left. Once you have selected the users, the "Continue" button will be enabled. Otherwise, you can cancel the process by clicking the "Cancel" button.
Subgroups
Subgroups are an essential feature of user and permission management in Ironchip. They allow for a hierarchical organization of users and more efficient administration of rights and privileges within a security structure. In this section, subgroups will be created, managed, and leveraged in Ironchip.
To create a subgroup within this group, you should click the "Manage subgroup" button within the "Options" dropdown.
A window will appear with the name of the group to be edited. You will see two tabs, one with the subgroups already added to this group, and another with the subgroups that are not yet added.
Click on the "Add Children" tab, and a list will be displayed with all the groups. You can choose the subgroups you want for that group by simply clicking on the checkbox to the left. Once you have selected the subgroups, the "Continue" button will be enabled.
To remove any already added subgroup, you should click on the "Remove Children" tab. Similarly to the previous step, a list will be displayed with all the groups already added. You can choose the subgroups you want to remove for that group by clicking on the checkbox to the left. Once you have selected the subgroups, the "Continue" button will be enabled.
Otherwise, you can cancel the process by clicking the "Cancel" button.
Keys
In this section, the devices of each user and the created safe zones are displayed. On each "Key," you can see the type (safe zone, mobile, or desktop), who created it, and the related groups.
Additionally, you can delete a "Key," make it public so that different users can use it, or make it private for exclusive use by the creator. 
Safe Zones
Safe zones are unique and non-replicable geographical locations from which users typically operate. These zones can be configured to ensure access security and prevent fraudulent operations from unauthorized locations. Administrators can manage safe zones and assign users to them from the management panel.
What is a safe zone?
A safe zone is an area from which the user typically operates. Fraudulent activity tends to occur from locations outside safe zones. Additionally, a safe zone is a unique and irreplaceable geographical location. An administrator can enforce that users only authenticate from the established safe zone.
The concept of safe zones is also complemented by the Ironchip device recognition system.
1. This created key can be viewed in the "Keys" section of the "Management Panel".
How to make a safe zone public:
To make a safe zone public, you must first create it from your mobile device as usual. Once you have created it, go to the "Directory users" tab where you will see a list of your devices and safe zones.
By clicking on the "Make Public" button, you can make it visible to all users in the company. For example, a common public zone could be the office.
Configuration
In the configuration section, additional adjustments and customizations can be made to the platform. This includes configuring key groups, integrating LDAP passwords, user synchronization, and more. These settings allow the platform to be tailored to the specific needs of the company.
In the key section of the management panel, two types of keys can be observed. Personal keys, which can only be used by their creators, and company keys, which can be used by any user registered in the company.
To share a key, click on "Make Public", and it will change to the company key card. Only personal keys that are not associated with a service can be deleted.
Key groups
In this section, you will find information about the different "Keys" organized into groups, which will make it easier for you to add access to user groups.
A "Key group" groups, for example, all personal keys or all keys used in an office.
To the right, you can find a list of groups that will be added by default, including "Any user devices" and "Any user safe zones," as well as any access groups you have created in the company. At the top right, you will find a button to create a new Key Group, called "New Key Group." Clicking this button will open a new window where the first step is to assign a name to the label, and finally, you should click the "Continue" button.
Now you can see the newly created Key Label added to the list of labels on the screen. There you can delete the label with the Delete icon or, if you prefer, assign all the accesses that will belong to that label by clicking the "Configure" button.
The displayed window will show the name of the label being edited, as well as a table with information about all the Devices and Safe Zones that are currently configured in the company, including detailed information such as the name, type, and platform. Additionally, there will be a column on the left with checkboxes to select the desired accesses. You also have an option to Sort to organize the selected options and give you a better view of the chosen keys before continuing with the configuration.
Once you have made your selection of what you want to add to the label, click on the "Continue" button. This configuration can be modified whenever necessary by simply clicking the "Configure" button.
LDAP password integration
Integration process
Within the “Key groups” section you have to click on the “New key group” button (upper right corner).
The integration process involves creating key groups using the LDAP protocol, in which you have to add some configuration such as the server URL and certificate in case you want to enable secure TLS. 
You can also modify any field already added previously, however, if you want to add key groups with the LDAP protocol, you will make sure that it works correctly by asking for a username and password as an example.
In addition, once created you have the possibility of testing with different users in the key group options. 
Authentication
Since you have a key group through LDAP, let's configure it in an access to start the authentication process. Note that the concept of “Username” on a service is not the same as that used to authenticate with the LDAP server, in fact, the user's email address itself is used to authenticate with the LDAP server.
The authentication process in a service starts like any other by accessing with your previously configured “Username”.
If a key group with LDAP has been required for access, the following warning will appear asking you to add the password for your relevant email. 
And finally, if you have configured access with another type of key group like your device, don't forget to check your Ironchip application to finish the process and be able to enter the service.
Synchronization
In this section you will find two different sections:
• User synchronization with CVS: With this you will be able to synchronize the desired number of users with a CSV file.
• Synchronization with LDAP (Automatic Synchronization): With this you will be able to automatically synchronize users from the Active Directory.
Synchronizing users with CVS
Synchronization with CVS allows you to synchronize any number of users using a CSV file. To carry out this process, the following steps must be followed:
1. Download the template: In the user sync section, you will find the option to download a template in CSV format. This template must be completed with the information of the users you wish to synchronize.
2. Upload the template: Once the template is completed, it must be uploaded again to the Ironchip platform. This will allow the platform to recognize the information and synchronize users.
3. Configure synchronization: At this stage, you must select the group to which you want to add the synchronized users. You can also set additional options, such as removing users who are not included in the new synchronized data.
4. Review and finish: Before finishing the synchronization process, a summary will be displayed with the information of the synchronization carried out. It is important to review this information carefully before continuing.
To do this, click on “Synchronize Users”, located to the right of the current window. A window will open where you will do the first step (Step 1) of the user synchronization process, which is to download the template where you must upload the information of the users you want to synchronize. It is important that you carefully read the information provided in this window, as it provides detailed information on the correct filling of the template and other important information, such as the correct extension that the template must retain for correct synchronization. Press the “Download Template” button and then “Continue”.
Once the necessary information has been uploaded to the template, on the next screen you will find the second step (Step 2) of the synchronization process, which will be to upload the template that you downloaded and filled out in the previous step. To do this, you must either drag it to the area indicated, or load it by clicking on the area that will open a list of files from which you must select it. 
Once the template with the information has been correctly loaded, press the “Continue” button. 
On the next screen you will find the third step (Step 3), in this part you will have different options including:
• Add users to an existing group on the platform: If a user in the current group is not included in the new synchronized data, there will be the following boxes:
◦ Delete the user from the selected group.
◦ Also delete the user from the platform.
It is necessary to carefully read the information provided in the messages to avoid taking actions that we do not want.
Then we must select the “I want to continue” box, and press the “Continue” button.
• Add users to a default group on the platform (AllUsers, Personal-Group): A message will appear with the following information:
“You are about to update the company user group with new user data. This can permanently remove users from the company. Please note that all deleted user data, keys and access will be lost and cannot be recovered.”
It is important to read the messages, since they will prevent us from taking actions that are not what we really want to take. Then you must select the “I want to continue” box, and press the “Continue” button.
In the last step (Step 4), you have a summary with the final sync information. Please read the user synchronization summary carefully before continuing, as some actions may be irreversible:
• Imported Template: {filename}.csv.
• The synchronized users will be part of the group: {SelectedGroup}.
• If a user is currently part of the {SelectedGroup} and is not included in the new synchronized data, they will cease to be part of the group and will be deleted.
Then you must select the box where it indicates: “I have checked the synchronization summary”, press the “Finish” button and, in case of any doubt, you can return to the previous windows with the “Back” button.
Finally, on the main screen you will have a summary with the information about the synchronization carried out and if there is any failure during the process, you will be informed.
Synchronizing users with LDAP (automatic synchronization)
LDAP synchronization allows users to automatically synchronize from the company's Active Directory. This method is especially useful when you want to keep the Ironchip user database updated with Active Directory information.
To synchronize with LDAP, follow these steps:
1. Configure Integration: In the user synchronization section, you will find the option to configure LDAP synchronization. At this stage, you must assign an alias to the integration and configure the necessary parameters, such as the LDAP server URL and certificate if using secure TLS.
2. Run the commands: Once the integration is configured, a series of commands will be generated that must be executed in the Windows PowerShell command console. These commands will allow you to establish the connection with the Active Directory and synchronize users.
3. Verify synchronization: Once the commands have been executed, you must verify that synchronization has been carried out correctly. In case of any error, an error message will be displayed that must be reviewed and corrected.
Within the synchronization section, you will have the option to synchronize users who are in an Active Directory group with LDAP, called an automatic synchronization. When you press the button, a window will be displayed where you will enter the name of the group to which you are going to add the users that you will synchronize from the Active Directory.
This group may or may not exist on the dashboard. However, in either case, once the group is selected, if a user in the current group is not included in the new synchronized data you will have two options:
• Delete the user from the selected group (Illustration 1).
• Also delete the user from the platform (Illustration 2).
ILLUSTRATION 1. DELETING THE USER FROM THE SELECTED GROUP.
ILLUSTRATION 2. DELETION OF THE USER FROM THE PLATFORM.
Note: It is important to carefully read the messages that appear when selecting these two options, since there are actions that may be irreversible.
Now you must copy the commands that have been generated in the established order and execute them in the Windows PowerShell command console.
1. PowerShell command.
2. CURL command. 
3. If everything went correctly, you will see a return message like the one in the image. Otherwise, you will receive an error message. 
SCIM – User synchronization with Azure
Within the synchronization section there is no option to synchronize users who are in an Azure Active Directory group. This must be programmed with the Ironchip team, since a key provided by the company will be needed. The steps to follow for this synchronization are as follows:
1. First of all, we must enter Azure as an administrator and go to the “Enterprise applications” section and click on the “New application” button in the top menu.
2. In the new window that opens in the upper left, click where it says “Create your own application”, which will display a window on the right. In this window we select the last option “Integrate any other applications you don't find in the gallery (Non-gallery)” in addition to providing a name to the application. Finally, click on “Create” to finish the creation process. 
3. Once the application is created, entering it, we must assign the users and groups that we want to synchronize with the Ironchip platform. To do this, in the “Getting Started” section of the screen we will begin with the first step by clicking on “Assign users and groups”. 
4. In the new window, the users and groups to synchronize with Ironchip will be selected. These groups are synchronized with the same name on the platform. When they have been selected, click on “Select”. 
5. Returning to the previous window we will skip step 2 and configure the “Provisioning” section by clicking on it. Within this, a new “Get Started” button will appear, which you click to make the final configuration. 
6. In this window we will configure the provisioning with the following characteristics:
to. Provisioning mode: Automatic.
b. Tenat URL: https://api.ironchip.com/scim/v2
c. Secret Token: Will be provided by Ironchip. *
To know if all the fields are correctly completed, perform a connection test by clicking “Test Connection”. When the test has been carried out satisfactorily, click the “Save” button.
7. To finish the synchronization we must enter the “Provisioning” section again and execute it by clicking on “Start Provisioning”.
Finally, on the main screen you will have a summary with the information about the synchronization carried out and if there is any failure during the process, you will be informed.
MFA Integration
HTTP-MFA is a type of integration that the administrator can create and then create a service of that type.
Ironchip offers integration with third-party multi-factor authentication (MFA) systems, allowing for an additional layer of security when using third-party services for authentication. To do this, the following steps will be followed:
Within the “Directory” section, click “MFA Integrations” and then the “New Integration” button.
You must have created and entered an alias (a name) for the integration. The alias is used to assign a server or farm. 
Once installed, click on “Add Integration”. 
Download the “Api Key” so that when the time comes to integrate it you can have it at hand. 
Security
IDS
It is an intrusion detection system, in which you can monitor all the anomalies detected during the authentication of your users, from warnings to fraud detection. This will result in reports containing details about the type of failure, the date the failure occurred, and the affected user.
Within the “Security” > “IDS” section.
If you want to access more information about the anomaly, you can do so using the “View report” button associated with the report. This will redirect you to a control panel where the available information will be displayed.
Permissions
Permissions management is a critical part of Ironchip administration, allowing you to control access to resources and data within the organization. In this section, we will see how to assign permissions to groups and subgroups effectively.
Assigning permissions to groups in Ironchip simplifies administration, as you can grant or revoke access to multiple users at once.
The first thing to do is create new permissions by clicking on the “New Permission” button.
In the new window you must identify which group will be given permissions on which specific resources and click “Continue”.
When the group and resources have been chosen, it is time to configure the permissions according to the needs and the process will be completed after checking if everything is correct.
Once the permissions have been created in the “Permissions” section, all the permissions will appear with the assigned resources and the need or accepted operation for each one. These can be deleted and also edited by pressing the “Edit permission” button. 
As can be seen in the previous image, on the right the details of the selected permissions appear to have a quick view of them.
Activity Logs
The “Activity Logs” section ensures monitoring and analysis of activity and event logs that are essential to ensure the security, performance and integrity of the platform. In this section you can detect problems, perform analysis and take proactive measures since the platform will display a variety of events and logs, which may include:
• Successful/Failed Accesses: Log of logins and authentication failures.
• Configuration Changes: Events that indicate changes in system configuration.
• Errors and Exceptions: Events that signal errors in the normal operation of the system.
• User Activity – Record of actions performed by users, such as creating or deleting resources.
Additionally, the most important details of the selected log are shown on the right, such as the type of event, the user who performed it, and how long ago it occurred.
Metrics
Within the management panel, there is the metrics section, where you can see different statistics related to the company. These metrics include the number of authentications performed, the number of services and registered users, daily authentication activity, and more. These metrics provide valuable information about the use and security of the platform and the ones you can find are the following:
• Authentications: The number of authentications that have been carried out in the company, differentiating between correct and incorrect ones.
# of Services: The number of services that have been created and protected in the company.
No. of Users: The number of users who have registered with the company.
• Daily activity: The number of authentications that have been carried out in the company day by day in the selected month, differentiating between correct and incorrect ones using a graph.
• Timeline: Authentications carried out in the company in real time; The authentication properties that can be seen are: o In which service and at what time a user has authenticated.
The keys that have been used, that is, device and secure area if required. If a secure zone has been used, the percentage with which the service has been accessed will appear. o The result of the authorization; correct or incorrect.
In addition to having the general metrics of the company, you will also be able to access different metrics related to each user or service. In this case, the metrics that you can find for users are:
• Authentications: The number of authentications that the selected user has carried out, differentiating between correct and incorrect ones.
No. of Services: The number of services to which the selected user has access.
Number of Keys: The number of keys to which the selected user has access, both personal and shared.
And the metrics for the services:
• Authentications: The number of authentications that have been performed on the selected service, distinguishing between correct and incorrect ones.
No. of Users – The number of users who have access to the selected service.
Number of Keys: The number of keys with which the selected service can be accessed, both personal and shared.
Plugins
Ironchip plugins are additional tools that can be integrated with other systems or services to improve security and authentication. These plugins are designed to work with specific systems and provide an additional layer of protection.
In this last section of the “Management Panel” you will access all the plugins programmed for the different integrations, in fact, you will find the downloadable ones there. The plugins developed in this section are:
• Windows NPS – The Windows NPS plugin allows you to integrate Ironchip with Windows Network Policy Server (NPS). This allows Ironchip authentication to be used to access NPS-protected network resources.
• ADFS – The ADFS (Active Directory Federation Services) plugin allows you to integrate Ironchip with ADFS, making it easy to authenticate users to ADFS-based applications and services using Ironchip credentials.
• LDAP – The LDAP plugin enables integration of Ironchip with LDAP servers, enabling automatic user synchronization and authentication using Ironchip credentials.
• Windows Logon – The Windows Logon plugin enables user authentication on Windows systems using Ironchip. This improves security by requiring additional authentication before accessing the system.
To access the documentation related to the different integrations, you can consult the Help center on the Ironchip website, which you can find at the link below: https://knowledge.ironchip.com/es
Billing
License management in Ironchip is essential to control the number of users and secure zones that can be used on the platform. Each license has a set limit and it is important to ensure that this limit is met to avoid access problems.
If you need to expand the number of users or safe areas, you can change the contracted license. There are different types of licenses available, each with its own properties and limits.
It is important to take into account the contracted licenses and ensure that the established limits are met to avoid access problems and guarantee proper functioning of the platform.
In the licenses section you can consult the license plan currently contracted. And in the license you can see the number of registered users and the safe areas already shared compared to those contracted respectively.
The license may be changed to expand the number of users and shared secure areas. There will be three types of licenses and their properties will be described in it.
