HashiCorp Boundary

This guide integrates Ironchip with Boundary to add a layer of security using Ironchip’s passwordless login, through OIDC.

Requirements

• A deployed Boundary.
• Access to the Ironchip admin console.

Configure Boundary

1. Go to Auth Methods.

   

2. Click New and choose OIDC to create a new auth method.

   

3. Give it an identifying name. In Client ID and Client Secret, enter any value so Boundary lets you save. You will change them later.

   

4. In API URL Prefix, enter the access address of Boundary. When you save, Boundary returns a URL that you use in Ironchip.

   

Configure Ironchip

1. In the Ironchip admin console, create a new OIDC application and enter the URL you got from Boundary.

2. Download the document with the necessary IDs.

3. Add the users you want to the application.

   

   

Finish the configuration in Boundary

1. Back in the Boundary auth method, enter the data from the Ironchip document in the corresponding fields: Issuer, Client ID, and Client Secret.

   

2. Add the remaining fields in their corresponding place:

   • Signing Algorithms: RS256.
   • Claims Scopes: email, groups, and profile.
   • Account Claim Maps: email to email, and external_username to name.

   

Verify the integration

1. Sign out of Boundary and sign back in with the Ironchip option.

2. Enter the credentials of the user you added to the Ironchip application.

3. Authorize access with the notification from the mobile or desktop app.

   

   

If you want this user to have permissions in Boundary, add its credentials to the Boundary administrator.

Integrating Ironchip with BoundaryPlay video

Troubleshooting

The Docker machine cannot resolve the domain ironchip.com. Add the domain to the /etc/hosts file of the machine that resolves the domain.

When you check the issuer, https://idp.ironchip.com/oidc/ appears and an error occurs. Remove the / at the end.