# HashiCorp Boundary

> Integrate Ironchip with HashiCorp Boundary using OIDC for passwordless login: create the auth method, the OIDC application, and verify access.

URL: https://docs.ironchip.com/en/identidad/integraciones/puestos/boundary/

This guide integrates Ironchip with Boundary to add a layer of security using Ironchip's passwordless login, through [OIDC](https://docs.ironchip.com/en/identidad/protocolos/oidc/).

## Requirements

- A deployed Boundary.
- Access to the Ironchip admin console.

## Configure Boundary

1. Go to **Auth Methods**.

   [Image: Authentication methods menu in Boundary]

2. Click **New** and choose **OIDC** to create a new auth method.

   [Image: Creating an OIDC authentication method]

3. Give it an identifying name. In **Client ID** and **Client Secret**, enter any value so Boundary lets you save. You will change them later.

   [Image: Method name and placeholder Client ID and Client Secret]

4. In **API URL Prefix**, enter the access address of Boundary. When you save, Boundary returns a URL that you use in Ironchip.

   [Image: API URL Prefix field with the Boundary address]

## Configure Ironchip

1. In the Ironchip admin console, create a new OIDC application and enter the URL you got from Boundary.
2. Download the document with the necessary IDs.
3. Add the users you want to the application.

   [Image: Creating the OIDC application with the Boundary URL]

   [Image: Users added to the application]

## Finish the configuration in Boundary

1. Back in the Boundary auth method, enter the data from the Ironchip document in the corresponding fields: **Issuer**, **Client ID**, and **Client Secret**.

   [Image: Issuer, Client ID and Client Secret fields of the OIDC auth method in Boundary]

2. Add the remaining fields in their corresponding place:

   - **Signing Algorithms**: `RS256`.
   - **Claims Scopes**: `email`, `groups`, and `profile`.
   - **Account Claim Maps**: `email` to `email`, and `external_username` to `name`.

   [Image: Signing Algorithms, Claims Scopes and Account Claim Maps of the OIDC auth method in Boundary]

## Verify the integration

1. Sign out of Boundary and sign back in with the Ironchip option.
2. Enter the credentials of the user you added to the Ironchip application.
3. Authorize access with the notification from the mobile or desktop app.

   [Image: Signing in to Boundary with the Ironchip option]

   [Image: Ironchip authorization notification]

If you want this user to have permissions in Boundary, add its credentials to the Boundary administrator.

Video: [Integrating Ironchip with Boundary](https://play.hubspotvideo.com/v/7745202/id/147405347180)

## Troubleshooting

**The Docker machine cannot resolve the domain `ironchip.com`.** Add the domain to the `/etc/hosts` file of the machine that resolves the domain.

**When you check the issuer, `https://idp.ironchip.com/oidc/` appears and an error occurs.** Remove the `/` at the end.