# Authenticate with Ironchip

> How to authenticate with Ironchip on web services, Windows and Linux: push notification, USB, offline code and password change.

URL: https://docs.ironchip.com/en/identidad/usuarios/autenticacion/

This guide explains how you authenticate with Ironchip depending on the service you access: with the app and a push notification, at the Windows or Linux sign-in, or on web services through SAML or OIDC.

## Authentication process

You can authenticate in two ways.

### From the push notification

1. Enter your credentials in the service you want to access. A push notification arrives on your phone through the Ironchip app.

   [Image: Ironchip push notification on the phone]

2. Tap the push notification. The Ironchip app opens, where you must enter the selected biometrics if it was set as a requirement.

   [Image: Ironchip app asking for biometrics after opening the notification]

3. Tap **Authorize**. The signal scanning screen opens and verifies whether you are in the authorized location for accessing the service. If you are in the correct location, you get access to the service.

   [Image: Signal scanning screen that verifies the location]

### From the app

1. Enter your credentials in the service you want to access. A push notification arrives on your phone.
2. Instead of tapping the notification, open the app directly and go to **Services**. On the service where you entered your credentials, a countdown timer shows how many seconds are left to run the signal scan and verify your identity. Tap the service card.

   [Image: Service card with the countdown timer in the services tab]

3. Tap **Authorize**. The signal scanning screen opens and verifies whether you are in the authorized location. If you are in the correct location, you get access to the service.

## Windows logon

With Windows Logon you access your Windows services securely, using security factors in addition to your usual password. If you are an administrator and need to install it, see [Install the authenticator on Windows](https://docs.ironchip.com/en/identidad/usuarios/autenticador-windows/). There are three options:

- **Push notification**: a notification arrives on your phone so you can authorize the sign-in.
- **Offline**: you access the computer without an internet connection using a code provided by the app.
- **USB**: you access the computer without authorizing anything, because the USB drive authorizes the access itself.

[Image: Windows sign-in screen with the Ironchip logo]

If you have more than one user, the first drop-down list lets you choose which user to sign in with. Fill in the required fields, such as username and password.

[Image: Ironchip Login screen on Windows with the user drop-down list and the username and password fields]

### With push notification

After you enter your sign-in details, a notification arrives on your phone asking you to authorize the sign-in.

[Image: Windows Logon screen in the mobile app with the Cancel and Authorize buttons]

### With USB

To use this mechanism, you must have enrolled with a USB drive beforehand. See [Enrollment](https://docs.ironchip.com/en/identidad/usuarios/alta/).

Fill in the required fields, such as username and password. Because the USB drive is inserted in the computer, you don't need to authorize anything: the USB drive does it automatically.

### Offline

You can authenticate to services without an internet connection with the Offline feature, which uses an offline code to verify your identity instead of authorization from the phone.

1. Open the offline authenticator application, which gives you a link. With that link you can create one of your offline keys: enter your Windows username in **Windows Username** and click **Generate**. If you don't clearly remember the user you sign in with, ask your administrator for help.

   [Image: Generate offline key screen with the Windows Username field and the Generate button]

2. When the offline key is generated, a QR code appears to add it to the mobile app, along with a text code to copy and paste into the desktop app.

   [Image: Generated offline key with the QR code and the Copy text code to clipboard button]

3. In the mobile app, go to the second tab at the bottom right, the one with the padlock icon. Tap the round green **+** button at the bottom right and choose **Scan a QR code**.

   [Image: Padlock tab in the mobile app with the + button and the Scan a QR code option]

4. Scan the generated QR code or manually enter the **Setup KEY**. If everything went as expected, a new entry appears with your OTP code, which is regenerated every 30 seconds.

   [Image: New entry in the app with the OTP code and the 30-second countdown]

5. Tap the card that appeared to display the OTP code. The code is hidden again every 30 seconds.
6. On the Windows sign-in screen, enter the code shown by the app in the **OTP code** field.

   [Image: Offline Ironchip Login screen on Windows with the OTP code field]

If you get an error saying that the offline (OTP) functionality is not installed (`Offline functionality is not installed`), you have two options:

[Image: Windows sign-in screen with the message that the offline functionality is not installed]

- Connect to the internet and sign in with a push notification or a USB drive.
- If you have no internet access, contact your administrator.

### Password change

To change your password, contact your administrator. After that, you see this window when you try to sign in. You also see it if your password has expired.

[Image: Password change window on the Windows sign-in]

1. Fill in the second field with the user you want to sign in as.
2. Fill in the third field with your previous password.
3. Fill in the fourth and fifth fields with the new password.

   [Image: Password change window with the fields filled in]

Once the password is changed, you see this message:

[Image: Password change confirmation message]

## Linux logon

With Linux Logon you access your Linux services securely. Depending on your administrator's requirements, the system can ask for your authorization at sign-in, when you escalate privileges in Linux (`sudo`) or when you use the `ssh` service.

[Image: Linux sign-in screen protected with Ironchip]

Once your administrator has installed Linux Logon on your computer, sign in. A push notification arrives on your phone so you can authorize the access.

[Image: Linux PAM authorization screen in the mobile app, with the Cancel and Authorize buttons]

## Web services

The Ironchip platform lets you access company services from the browser. There are two ways to sign in, SAML or OIDC.

### With SAML

You see a page like the one below. Sign in by clicking **Login with Ironchip**.

[Image: Web service page with the Login with Ironchip button]

1. Click the red button, enter your usual email address and click **Send notification**. A push notification arrives from the Ironchip app.

   [Image: Screen for entering the email address and sending the notification]

   [Image: Ironchip app authorization screen, with the Cancel and Authorize buttons]

2. Accept the notification in the app by tapping **Authorize** to get access to the platform.

### With OIDC

The second way to sign in on the web is similar to the screen below.

[Image: Web service page with the Ironchip Authentication button]

1. Click the gray rectangular button at the bottom, **Ironchip Authentication**. This button can also appear as **Sign in with OIDC**. Clicking it opens an additional tab.
2. In the new tab, enter your usual email address and click **Send notification** to receive the push notification.

   [Image: Ironchip tab for entering the email address and sending the notification]

3. Accept the notification that arrives on your phone to get access to the platform.

   [Image: Access authorization screen in the Ironchip app, with the Cancel and Authorize buttons]