# Centralized validation

> Validate certificates, LDAP, RADIUS and OTP/MFA from a single point: integrated and passthrough modes, per-service setup and the authentication policy.

URL: https://docs.ironchip.com/en/identidad/protocolos/validacion-centralizada/

Ironchip acts as the single validation point for certificates, LDAP, RADIUS and OTP/MFA. This page explains how to configure each service and how to combine them in an authentication policy.

## Requirements

- Access to the Ironchip admin console with the administrator role.
- For passthrough mode: connectivity from Ironchip to your existing LDAP, RADIUS or OTP servers.
- For certificate validation: at least one CA configured in Ironchip or imported as a trusted CA.

## Validation modes

For each service you can choose between two modes:

| Service      | Integrated mode                               | Passthrough mode                                                  |
| ------------ | --------------------------------------------- | ----------------------------------------------------------------- |
| Certificates | Validation with Ironchip CAs, CRL and OCSP    | Validation against trusted external CAs and their CRL or OCSP     |
| LDAP         | Ironchip directory of users and groups        | LDAP proxy to the existing directory (Active Directory, OpenLDAP) |
| RADIUS       | Ironchip RADIUS server                        | The request is forwarded to an external RADIUS server             |
| OTP/MFA      | Ironchip factors (mobile app, FIDO2 key, OTP) | The code is validated on an external OTP server                   |

You can combine both modes. For example, you can validate the device certificate with the integrated CA, the user against your Active Directory through passthrough, and the second factor with Ironchip.

## Configure certificate validation

Go to **Settings**, **Certificate validation** section, and configure:

- **Trusted CAs**: integrated CAs and external CAs that are considered trusted. To add an external CA, click **Add trusted CA** and upload its certificate.
- **Revocation check**: OCSP, CRL or both. OCSP with CRL as a fallback is recommended.
- **On failure**: what to do if the revocation status cannot be queried. Select **Deny** (recommended) or **Allow**.
- **Mapping**: certificate field that identifies the user or device (CN, SAN or serial number).

From then on, any service that uses Ironchip certificate validation, such as [TACACS+](https://docs.ironchip.com/en/identidad/protocolos/tacacs/), RADIUS with EAP-TLS or mTLS, checks the chain, validity period and revocation of the certificate.

## Configure LDAP

1. Go to **Settings**, **Directory** section, and click **Add directory**.
2. Choose the mode:
   - **Integrated**: uses the Ironchip directory of users and groups, synchronized with [Entra ID](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/entra-id/) or with [Ironchip AD Connect](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/ad-connect/).
   - **Passthrough**: uses the [LDAP proxy](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/proxy-ldap/) to validate credentials directly against your LDAP server, without copying users to Ironchip. Fill in these fields:
     - **Server**: address and port of the LDAP server, for example `ldaps://dc01.example.local:636`.
     - **Bind DN**: service account with read permissions.
     - **Base DN**: directory branch where users are searched.
     - **User filter**: search filter, for example `(sAMAccountName={username})`.
3. Click **Test connection** to verify access and then **Save**.

## Configure RADIUS

Go to **Settings**, **RADIUS** section, and select the mode:

- **Integrated**: Ironchip acts as a RADIUS server through the [Ironchip RADIUS server](https://docs.ironchip.com/en/identidad/protocolos/radius/), with PAP and EAP-TLS support. Register the client devices in **Clients** with their IP address and shared secret.
- **Passthrough**: Ironchip receives the request and forwards it to an external RADIUS server, and keeps control of the policy and the second factor. Fill in these fields:
  - **Upstream server**: address and port of the external RADIUS server.
  - **Shared secret**: secret shared with the external server.
  - **Timeout** and **retries**: wait time and number of retries before the server is considered unavailable.

## Configure OTP/MFA

Go to **Settings**, **MFA** section, and define which factors are available:

- **Ironchip**: mobile app, desktop app, FIDO2 key and Ironchip [OTP](https://docs.ironchip.com/en/identidad/protocolos/otp/).
- **External OTP (passthrough)**: Ironchip asks the user for the code and validates it against an external OTP server through RADIUS. Enter the server address and the shared secret.

In **Enforcement**, select whether the second factor is required, optional, or required only when the location or connection context is risky.

## Define the authentication policy

Once you have configured the services, define the order in which they are validated.

1. Go to **Policies** and click **New policy**.
2. Select the application the policy applies to, for example the TACACS+ application or a VPN.

A typical policy for administrator access is this:

1. Valid device certificate, issued by the Ironchip CA.
2. User and group validated against LDAP through passthrough.
3. Ironchip second factor, required.

If any of the steps fails, the authentication is rejected and the reason is recorded in **Events**. You can export these events to your SIEM through [ITDR event export](https://docs.ironchip.com/en/identidad/administracion/exportacion-de-eventos/).

:::tip[Test in Audit mode first]
Before enabling a policy in production, use **Audit** mode: it records the result of each validation without blocking access, so you can check that no legitimate user would be excluded.
:::