App distribution

The Ironchip mobile app is distributed publicly, privately, or as a custom-branded app. Desktop agents are deployed at scale with GPO, MDM, or other management tools.

Mobile app

Public distribution

Download the app from your device’s store.

Google Play (Android):

1. Open the Play Store app on your device.
2. Search for Ironchip.
3. Download the app.

App Store (iOS):

1. Open the App Store app on your device.
2. Search for Ironchip.
3. Download the app.

Private distribution

Ironchip has a private app repository for organizations that need one, such as those that centrally manage their corporate mobile devices. There are two options:

• MDM: on-demand private distribution, integrated into the corporate MDM platform (for example, Microsoft Intune, VMware Workspace ONE, JAMF for iOS, or Kandji). Ironchip provides the app package so you can distribute it silently.
• Private link: Ironchip provides a private link for direct download within the organization, without going through the public stores.

Tip

MDM distribution is the recommended method in corporate environments with active EMM (Enterprise Mobility Management). Contact the Ironchip team to get the private distribution package.

Custom app

Ironchip offers a custom app that matches your company’s look: logo, colors, and application name. You can deploy it publicly (stores) or privately (MDM or link). Contact the Ironchip team so that all your requirements are included.

Supported devices

• Android 6.0 or later. Electromagnetic signals are available from Android 8.0.
• iOS 10.0 or later.

Desktop agent for Windows

The desktop agent (Ironchip Desktop App) for Windows is distributed as an .msi installer. You can download it from the Plugins section of the console or from GitHub (Ironchip-Windows-Logon). There are three deployment methods.

Mass deployment with GPO

This is the recommended method for on-premises AD.

1. Download the .msi installer from the Plugins section of the console.
2. On the domain server, open the Group Policy Management Console (GPMC).
3. Create or edit a GPO and link it to the organizational unit (OU) that contains the target computers.
4. Go to Computer Configuration > Policies > Software Settings > Software installation and add the .msi package.
5. The software installs automatically on all domain computers at the next restart or when policies refresh (gpupdate /force).

You can preconfigure the Ironchip company API key in the GPO so the installation is fully silent, with no user interaction.

Note

With GPO you can turn on Exclude other providers through an installation parameter. This makes Ironchip the only Windows credential provider on every computer in the OU, with no manual intervention.

Deployment with MDM or Intune

This is the recommended method for cloud or hybrid environments.

1. Upload the .msi installer to Microsoft Intune (or an equivalent MDM tool).
2. Create an app deployment policy assigned to the target device group.
3. Configure the silent installation parameters (API key and production environment).
4. Intune deploys the app to the assigned devices at the next sync cycle.

It is compatible with Microsoft Intune, SCCM / Microsoft Endpoint Configuration Manager, Jamf (macOS), Kandji (macOS), and ManageEngine MDM.

Manual installation

For pilots or small groups: run the .msi installer directly on the computer and enter the API key in the installation wizard. This isn’t recommended for deployments of more than 20 computers.

For more information about the agent, see Windows logon.

Desktop agent for Linux and macOS

Linux

The Ironchip PAM module for Linux (pam_ironchip_auth.so) is distributed from the Plugins section of the console. To deploy it across a fleet of Linux servers, use Ansible, Puppet, or Chef to automate copying the module and editing the files in /etc/pam.d/ on all target servers.

Example with Ansible:

ansible-playbook ironchip_pam.yml -i inventario.ini

macOS

The PAM module for macOS is distributed with JAMF Pro or Kandji. The flow is:

1. Upload the .pkg of the PAM module to JAMF.
2. Create a deployment policy assigned to the corporate Macs.
3. Run a post-installation script that automatically edits the file in /etc/pam.d/ with the company API key.

For more information, see macOS logon.

RFID agent

The IronchipRFID.exe agent is distributed from the Plugins section of the console. To deploy it on several computers with RFID readers:

1. Distribute the executable with GPO or with a software deployment tool.

2. Configure the API key with a PowerShell script that runs as a logon task or as a GPO script. The configuration command is:

   .\IronchipRFID.exe c --api_key <API_KEY>

You can fully automate this process on domain computers, with no user intervention. For more information, see RFID.

USB allowlist with GPO

To allow only specific USB devices on domain computers:

Get the hardware ID of the USB device

1. Open Device Manager.
2. Find the USB device and open its properties.
3. Go to the Details tab and select Hardware Ids in the drop-down menu. Write down the hardware ID.

Allow specific devices

1. Open the Group Policy Editor (gpedit.msc).

2. Go to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.

3. Open the policy Allow installation of devices that match any of these device IDs.

4. Set it to Enabled.

5. Click Show.

6. Enter the hardware ID of the USB device you wrote down.

   

Block unapproved devices

1. In the Group Policy Editor, go to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.

2. Open the policy Prevent installation of devices not described by other policy settings.

3. Set it to Enabled.