# Integration protocols

> How to choose between OIDC, SAML, RADIUS, TACACS+ and the HTTP API to protect an application with Ironchip, and the steps every integration shares.

URL: https://docs.ironchip.com/en/identidad/protocolos/

Ironchip protects any service through standard protocols. The choice depends on where the user authenticates and what the service supports.

| Protocol                                       | What it is for                                                                                | Examples                                               |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
| [OIDC](https://docs.ironchip.com/en/identidad/protocolos/oidc/)         | Modern web and mobile applications. Ironchip acts as the identity provider and issues tokens. | Nextcloud, HashiCorp Vault and Boundary, in-house apps |
| [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/)         | Federation with corporate suites and SaaS.                                                    | Microsoft 365, Google Workspace, Salesforce, Palo Alto |
| [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/)     | VPNs, corporate wifi, firewalls and network equipment.                                        | Fortinet, Check Point, Stormshield, OpenVPN            |
| [TACACS+](https://docs.ironchip.com/en/identidad/protocolos/tacacs/)    | Network device administration with per-command authorization profiles.                        | Switches, routers and firewalls that support TACACS+   |
| [HTTP API](https://docs.ironchip.com/en/identidad/protocolos/http-api/) | Add Ironchip verification to in-house applications, with an API key.                          | Internal portals, custom applications                  |

To protect Remote Desktop connections, see the [RDP](https://docs.ironchip.com/en/identidad/integraciones/puestos/rdp/) guide. To protect LDAP authentication, see the [LDAP proxy](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/proxy-ldap/).

You can also use [one-time passwords (OTP)](https://docs.ironchip.com/en/identidad/protocolos/otp/) as a second factor and centralize the [validation of certificates, LDAP, RADIUS and OTP/MFA](https://docs.ironchip.com/en/identidad/protocolos/validacion-centralizada/). The [integrations](https://docs.ironchip.com/en/identidad/integraciones/) guides apply these protocols to specific products.

## What Ironchip supports natively

Ironchip natively supports these protocols and accesses:

- SAML and OIDC / OAuth 2.0.
- RADIUS NPS and passwordless RADIUS.
- LDAP.
- Windows Logon, RDP and hypervisors.
- Linux PAM, SSH, `sudo` and `su`.

[Image: Ironchip console with the RADIUS NPS server settings and the standard OIDC, SAML and Passwordless RADIUS protocols]

You can download the [applications and accesses document (PDF)](https://7745202.fs1.hubspotusercontent-na1.net/hubfs/7745202/02-aplicaciones-accesos.pdf).

## Before you start

Prepare the email addresses and names of the users you want to add. The person you add is registered first. This is done in a meeting.

## What all integrations share

1. **Add the application** in the console, in **Applications**, and choose the protocol in **Application integration type**.
2. **Save the credentials** that the console returns only once: the Client ID and Client Secret in OIDC, and the API key in RADIUS and in the HTTP API.
3. **Grant access to users and groups** from the **Add a new access** window. Each individual user is treated as a group with their own name.
4. **Choose the username format** (External Username) that the application receives: email by default, or a combination of tags such as `name`, `surname` or `domain`.
5. **Assign the authentication policies** that decide what is required for that group in that application, such as the user's device or safe zone.

The detailed steps are in [Applications](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/). The attributes Ironchip sends in SAML are on the [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/) page.

## Frequently asked questions

### How do I integrate in-house or custom applications?

The application makes a single HTTPS GET call to an Ironchip endpoint. When the user completes their authentication, the endpoint returns the validated identity so the application can grant or deny access.

- It needs no complex SDKs and works with any language.
- It does not change the existing authentication logic.

### Can I integrate an in-house application without SAML or OIDC?

Yes. A single HTTPS GET call to the Ironchip endpoint is enough:

1. The user tries to access the in-house application.
2. The application calls the Ironchip endpoint with the user identifier.
3. Ironchip shows the usual authentication flow (push, USB, NFC, etc.).
4. When the user finishes, the endpoint returns the validated identity.
5. The application uses that response to grant or deny access.

See the [HTTP API](https://docs.ironchip.com/en/identidad/protocolos/http-api/) guide.

### Can I protect access to an ERP (Navision, SAP, Oracle PeopleSoft)?

Yes, in several ways depending on the ERP:

- **Windows Logon**: protects the operating system that runs the ERP.
- **SAML or OIDC**: if the ERP supports it (SAP, Dynamics 365, Workday).
- **Direct API**: for ERPs with in-house development.
- **RADIUS**: to reach the ERPs through a corporate VPN.

### Does Ironchip require local infrastructure, or is it SaaS?

It is pure SaaS: it does not require heavy deployments in the customer's infrastructure. The customer only installs lightweight agents (desktop app, RADIUS connector and AD Connect agent). An on-premise option exists under a specific agreement for organizations with data sovereignty requirements or air-gapped networks.

### Can Ironchip provide contingency or failover environments?

Yes. Ironchip can provide contingency environments at no additional license cost, which work as a mirror of production to guarantee the continuity of the authentication service.

### How do I integrate Ironchip with the NPS server?

You install the MFA plugin for NPS on the NPS server. The process has three parts:

1. In the Ironchip console, create the integration and the application, and get the company API key.
2. In Network Policy Server, create the network policy you want to protect, with its conditions and settings.
3. Download the Ironchip plugin from the plugins section of the console, run the installer and enter the Ironchip host, the API key and the name of the network policy. Then check the plugin logs in **Event Viewer**.

The detailed steps, with screenshots, are in the [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) guide.

### How do I integrate Ironchip with ADFS?

You install the Ironchip MFA plugin on the ADFS server:

1. In the Ironchip console, create an API Key application and save the API key.
2. Download the plugin and run the installer on the ADFS server, entering the host and the API key.
3. In ADFS, enable the Ironchip MFA adapter as a multi-factor authentication method and protect the applications you want.
4. Check in **Event Viewer** that the plugin is installed.

The detailed steps are in the [ADFS](https://docs.ironchip.com/en/identidad/integraciones/saas/adfs/) guide.

[Download the NPS and ADFS documentation (PDF)](https://7745202.fs1.hubspotusercontent-na1.net/hubfs/7745202/Integraciones/Integration-Ironchip-plugin-NPS%26ADFS.pdf)