> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Troubleshooting the macOS SSO extension
> Diagnose why the Iru Access single sign-on extension on macOS isn't intercepting sign-ins, using Apple's built-in command-line tools.
Iru Access installs a macOS **single sign-on (SSO) extension** - a Redirect-type
Extensible SSO extension - that intercepts sign-ins to your Iru domains so people
sign in seamlessly with their device-bound credential. For it to work, macOS must
have **approved the associated domains** for the extension, which your MDM
normally pushes as part of the Iru Access configuration profile.
If sign-ins on a Mac aren't being intercepted by Iru Access, the checks below
confirm, in order, that the extension is **installed**, **loaded**, and that its
**associated domains are approved**. They use Apple's own command-line tools and
are safe to run on an enrolled Mac.
This page is for diagnosing an existing deployment. To set the deployment up in
the first place - the configuration profile, the app, and registration - see
[Deploy Iru Access](/en/identity/authentication/deploy-iru-access).
**Values used below.** `N5M3B34269` is Iru's Apple Team ID - the same value in
your Iru Access MDM profile - so the Iru Access App ID is always
`N5M3B34269.com.iru.Access`. `yourcompany.id.iru.com` stands in for your
organization's Iru sign-in domain; your real output shows your actual domains.
## 1. Confirm the associated domains are approved
The most common cause of a non-working SSO extension is that macOS has not approved
the **associated domains**. List every associated-domain approval on the Mac:
```bash theme={null}
sudo swcutil show
```
Look for an entry with **Service `authsrv`**, the Iru Access **App ID**
`N5M3B34269.com.iru.Access`, and your Iru sign-in domain - one entry per domain
your connection uses:
```
--------------------------------------------------------------------------------
Service: authsrv
App ID: N5M3B34269.com.iru.Access
Domain: yourcompany.id.iru.com
User Approval: unspecified
Site/Fmwk Approval: approved
Flags: enterpriseManaged
Last Checked: 2026-05-24 21:27:52 +0000
Next Check: 2026-05-29 20:38:54 +0000
--------------------------------------------------------------------------------
```
What to check:
* **`Site/Fmwk Approval: approved`** is the line that matters - it means Apple
validated the domain association for the extension. `denied`, or a missing entry,
means the association has not been validated yet.
* **`Flags: enterpriseManaged`** indicates the domain was pushed by your MDM, as
expected for a managed deployment. If it is missing, the configuration profile
with the Associated Domains payload may not have reached this Mac.
* There should be **one entry per Iru domain** your connection uses (a connection
may include more than one). A missing domain points to an incomplete profile.
## 2. Confirm the extension is installed
List the Iru Access app extensions registered with macOS:
```bash theme={null}
pluginkit -v -m
```
You should see the SSO extension, with a leading **`+`** meaning it is enabled:
```
+ com.iru.Access.SSOExtension(1.0) 8ACDABA9-0000-0000-0000-4E99DCF7F39D /Applications/Iru Access.app/Contents/PlugIns/SSOExtension.appex
```
What to check:
* A leading **`+`** means the extension is registered and enabled; a leading `-`
means it is present but disabled.
* No line at all means the Iru Access app is not installed, or its extension has
not registered yet. Confirm the app is deployed and has been launched once.
## 3. Confirm the system loaded the extension
Stream the system's SSO extension manager and look for Iru Access being loaded:
```bash theme={null}
log stream --debug --predicate 'category contains "SOExtensionManager"'
```
A healthy system logs the Iru extension as loaded (output similar to):
```
AppSSOAgent: (AppSSO) [SOExtensionManager] loadedExtensionWithBundleIdentifer:
com.iru.Access.SSOExtension =>
```
Any other single sign-on extensions installed on the Mac appear in the same list;
the one that matters here is `com.iru.Access.SSOExtension`.
## 4. Watch approvals and sign-in activity live
Two live streams help when an approval is slow to land, or when a sign-in is not
being intercepted.
**Associated-domain checks** - watch macOS schedule and record domain approvals:
```bash theme={null}
sudo swcutil watch --verbose
```
**The SSO agent** - watch the process that runs the extension during sign-in:
```bash theme={null}
sudo log stream --debug --process AppSSOAgent
```
When the associated domains are **not** yet approved, the agent logs messages like
these, which point straight at the cause:
```
com.iru.Access.SSOExtension hasAssociatedDomainsApproved = 0
Associated domain: validation failed for the SSO extension
com.iru.Access.SSOExtension because it has no approved associated domains; it will
be checked again when the extension is next used.
```
`hasAssociatedDomainsApproved = 0` means the domains are not approved yet. Once
approval lands, these errors stop and sign-ins to your Iru domains are intercepted
by Iru Access.
## Common causes and fixes
| Symptom | Likely cause | Fix |
| -------------------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| No `authsrv` entry in `swcutil show` | The Associated Domains payload did not reach the Mac | Re-deploy the Iru Access configuration profile from your MDM and confirm it is scoped to the device. |
| Entry present but `Site/Fmwk Approval` is not `approved` | macOS has not validated the domain association, or the domain is wrong | Confirm the domain matches your Iru domain exactly, ensure the Mac can reach it over the network, then trigger a sign-in and re-check. |
| `Flags` missing `enterpriseManaged` | The domains were not pushed by MDM | Use the MDM-delivered profile (managed deployment) rather than a hand-built one. |
| `hasAssociatedDomainsApproved = 0` in AppSSOAgent | Domains not approved | Resolve the associated-domain approval above. macOS re-checks periodically and when the extension is next used. |
| Extension missing from `pluginkit -v -m` | Iru Access not installed, or never launched | Deploy the app and launch it once so the extension registers. |
After fixing a profile, approvals do not always refresh instantly. Trigger a
sign-in to one of your Iru domains to prompt macOS to re-check, then re-run
`sudo swcutil show`.
## Where to go next
Set up the configuration profile, the app, and registration.
The connection that pushes the profile and makes a device count as managed.
Require managed, healthy devices as a condition of access.
How Iru Access fits alongside passkeys as an authenticator.