Skip to main content
Iru Access installs a macOS single sign-on (SSO) extension, a Redirect-type Extensible SSO extension that intercepts sign-ins to your Iru domains so users sign in with their device-bound credential. For it to work, macOS must have approved the associated domains for the extension, which your MDM normally pushes as part of the Iru Access configuration profile. If sign-ins on a Mac aren’t being intercepted by Iru Access, the checks below confirm, in order, that the extension is installed, loaded, and that its associated domains are approved. They use Apple’s own command-line tools and are safe to run on an enrolled Mac.
For diagnosing an existing deployment only. To set up the configuration profile, the app, and registration, see Deploy Iru Access.
Values used below. N5M3B34269 is Iru’s Apple Team ID, the same value in your Iru Access MDM profile, so the Iru Access App ID is always N5M3B34269.com.iru.Access. yourcompany.id.iru.com stands in for your organization’s Iru sign-in domain; your real output shows your actual domains.
1

Confirm the associated domains are approved

The most common cause of a non-working SSO extension is that macOS has not approved the associated domains. List every associated-domain approval on the Mac:
Look for an entry with Service authsrv, the Iru Access App ID N5M3B34269.com.iru.Access, and your Iru sign-in domain (one entry per domain your connection uses):
What to check:
Site/Fmwk Approval: approved is the line that matters. It means Apple validated the domain association for the extension. denied, or a missing entry, means the association has not been validated yet.
  • Flags: enterpriseManaged indicates the domain was pushed by your MDM, as expected for a managed deployment. If it is missing, the configuration profile with the Associated Domains payload may not have reached this Mac.
  • There should be one entry per Iru domain your connection uses (a connection may include more than one). A missing domain points to an incomplete profile.
2

Confirm the extension is installed

List the Iru Access app extensions registered with macOS:
You should see the SSO extension listed, for example:
What to check:
  • A com.iru.Access.SSOExtension line means the extension is registered.
  • No line at all means the Iru Access app is not installed, or its extension has not registered yet. Confirm the app is deployed and has been launched once.
3

Confirm the system loaded the extension

Stream the system’s SSO extension manager and look for Iru Access being loaded:
A healthy system logs the Iru extension as loaded (output similar to):
Any other single sign-on extensions installed on the Mac appear in the same list; the one that matters here is com.iru.Access.SSOExtension.
4

Watch approvals and sign-in activity live

Two live streams help when an approval is slow to land, or when a sign-in is not being intercepted.Associated-domain checks: watch macOS schedule and record domain approvals:
The SSO agent: watch the process that runs the extension during sign-in:
When the associated domains are not yet approved, the agent logs messages like these, which point straight at the cause:
hasAssociatedDomainsApproved = 0 means the domains are not approved yet. Once approval lands, these errors stop and sign-ins to your Iru domains are intercepted by Iru Access.

​
Common causes and fixes

After fixing a profile, approvals do not always refresh instantly. Trigger a sign-in to one of your Iru domains to prompt macOS to re-check, then re-run sudo swcutil show.

​
Where to go next

Deploy Iru Access

Set up the configuration profile, the app, and registration.

MDM connections

The connection that pushes the profile and makes a device count as managed.

Device trust

Require managed, healthy devices as a condition of access.

Authenticators

How Iru Access fits alongside passkeys as an authenticator.