Centralized validation

Ironchip acts as the single validation point for certificates, LDAP, RADIUS and OTP/MFA. This page explains how to configure each service and how to combine them in an authentication policy.

Requirements

• Access to the Ironchip admin console with the administrator role.
• For passthrough mode: connectivity from Ironchip to your existing LDAP, RADIUS or OTP servers.
• For certificate validation: at least one CA configured in Ironchip or imported as a trusted CA.

Validation modes

For each service you can choose between two modes:

Service	Integrated mode	Passthrough mode
Certificates	Validation with Ironchip CAs, CRL and OCSP	Validation against trusted external CAs and their CRL or OCSP
LDAP	Ironchip directory of users and groups	LDAP proxy to the existing directory (Active Directory, OpenLDAP)
RADIUS	Ironchip RADIUS server	The request is forwarded to an external RADIUS server
OTP/MFA	Ironchip factors (mobile app, FIDO2 key, OTP)	The code is validated on an external OTP server

You can combine both modes. For example, you can validate the device certificate with the integrated CA, the user against your Active Directory through passthrough, and the second factor with Ironchip.

Configure certificate validation

Go to Settings, Certificate validation section, and configure:

• Trusted CAs: integrated CAs and external CAs that are considered trusted. To add an external CA, click Add trusted CA and upload its certificate.
• Revocation check: OCSP, CRL or both. OCSP with CRL as a fallback is recommended.
• On failure: what to do if the revocation status cannot be queried. Select Deny (recommended) or Allow.
• Mapping: certificate field that identifies the user or device (CN, SAN or serial number).

From then on, any service that uses Ironchip certificate validation, such as TACACS+, RADIUS with EAP-TLS or mTLS, checks the chain, validity period and revocation of the certificate.

Configure LDAP

1. Go to Settings, Directory section, and click Add directory.
2. Choose the mode:
   • Integrated: uses the Ironchip directory of users and groups, synchronized with Entra ID or with Ironchip AD Connect.
   • Passthrough: uses the LDAP proxy to validate credentials directly against your LDAP server, without copying users to Ironchip. Fill in these fields:
     • Server: address and port of the LDAP server, for example ldaps://dc01.example.local:636.
     • Bind DN: service account with read permissions.
     • Base DN: directory branch where users are searched.
     • User filter: search filter, for example (sAMAccountName={username}).
3. Click Test connection to verify access and then Save.

Configure RADIUS

Go to Settings, RADIUS section, and select the mode:

• Integrated: Ironchip acts as a RADIUS server through the Ironchip RADIUS server, with PAP and EAP-TLS support. Register the client devices in Clients with their IP address and shared secret.
• Passthrough: Ironchip receives the request and forwards it to an external RADIUS server, and keeps control of the policy and the second factor. Fill in these fields:
  • Upstream server: address and port of the external RADIUS server.
  • Shared secret: secret shared with the external server.
  • Timeout and retries: wait time and number of retries before the server is considered unavailable.

Configure OTP/MFA

Go to Settings, MFA section, and define which factors are available:

• Ironchip: mobile app, desktop app, FIDO2 key and Ironchip OTP.
• External OTP (passthrough): Ironchip asks the user for the code and validates it against an external OTP server through RADIUS. Enter the server address and the shared secret.

In Enforcement, select whether the second factor is required, optional, or required only when the location or connection context is risky.

Define the authentication policy

Once you have configured the services, define the order in which they are validated.

1. Go to Policies and click New policy.
2. Select the application the policy applies to, for example the TACACS+ application or a VPN.

A typical policy for administrator access is this:

1. Valid device certificate, issued by the Ironchip CA.
2. User and group validated against LDAP through passthrough.
3. Ironchip second factor, required.

If any of the steps fails, the authentication is rejected and the reason is recorded in Events. You can export these events to your SIEM through ITDR event export.

Test in Audit mode first

Before enabling a policy in production, use Audit mode: it records the result of each validation without blocking access, so you can check that no legitimate user would be excluded.