> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting the macOS SSO extension

> Diagnose why the Iru Access single sign-on extension on macOS isn't intercepting sign-ins, using Apple's built-in command-line tools.

Iru Access installs a macOS **single sign-on (SSO) extension**, a Redirect-type
Extensible SSO extension that intercepts sign-ins to your Iru domains so users
sign in with their device-bound credential. For it to work, macOS must
have **approved the associated domains** for the extension, which your MDM
normally pushes as part of the Iru Access configuration profile.

If sign-ins on a Mac aren't being intercepted by Iru Access, the checks below
confirm, in order, that the extension is **installed**, **loaded**, and that its
**associated domains are approved**. They use Apple's own command-line tools and
are safe to run on an enrolled Mac.

<Note>
  For diagnosing an existing deployment only. To set up the configuration profile,
  the app, and registration, see
  [Deploy Iru Access](/en/identity/authentication/deploy-iru-access).
</Note>

<Info>
  **Values used below.** `N5M3B34269` is Iru's Apple Team ID, the same value in
  your Iru Access MDM profile, so the Iru Access App ID is always
  `N5M3B34269.com.iru.Access`. `yourcompany.id.iru.com` stands in for your
  organization's Iru sign-in domain; your real output shows your actual domains.
</Info>

<Steps>
  <Step title="Confirm the associated domains are approved">
    The most common cause of a non-working SSO extension is that macOS has not approved
    the **associated domains**. List every associated-domain approval on the Mac:

    ```bash theme={null}
    sudo swcutil show
    ```

    Look for an entry with **Service `authsrv`**, the Iru Access **App ID**
    `N5M3B34269.com.iru.Access`, and your Iru sign-in domain (one entry per domain
    your connection uses):

    ```
    --------------------------------------------------------------------------------
    Service:              authsrv
    App ID:               N5M3B34269.com.iru.Access
    Domain:               yourcompany.id.iru.com
    User Approval:        unspecified
    Site/Fmwk Approval:   approved
    Flags:                enterpriseManaged
    Last Checked:         2026-05-24 21:27:52 +0000
    Next Check:           2026-05-29 20:38:54 +0000
    --------------------------------------------------------------------------------
    ```

    What to check:

    <Warning>
      **`Site/Fmwk Approval: approved`** is the line that matters. It means Apple
      validated the domain association for the extension. `denied`, or a missing entry,
      means the association has not been validated yet.
    </Warning>

    * **`Flags: enterpriseManaged`** indicates the domain was pushed by your MDM, as
      expected for a managed deployment. If it is missing, the configuration profile
      with the Associated Domains payload may not have reached this Mac.
    * There should be **one entry per Iru domain** your connection uses (a connection
      may include more than one). A missing domain points to an incomplete profile.
  </Step>

  <Step title="Confirm the extension is installed">
    List the Iru Access app extensions registered with macOS:

    ```bash theme={null}
    pluginkit -v -m
    ```

    You should see the SSO extension listed, for example:

    ```
        com.iru.Access.SSOExtension(1.0)    8ACDABA9-0000-0000-0000-4E99DCF7F39D    /Applications/Iru Access.app/Contents/PlugIns/SSOExtension.appex
    ```

    What to check:

    * A `com.iru.Access.SSOExtension` line means the extension is registered.
    * No line at all means the Iru Access app is not installed, or its extension has
      not registered yet. Confirm the app is deployed and has been launched once.
  </Step>

  <Step title="Confirm the system loaded the extension">
    Stream the system's SSO extension manager and look for Iru Access being loaded:

    ```bash theme={null}
    log stream --debug --predicate 'category contains "SOExtensionManager"'
    ```

    A healthy system logs the Iru extension as loaded (output similar to):

    ```
    AppSSOAgent: (AppSSO) [SOExtensionManager] loadedExtensionWithBundleIdentifer:
      com.iru.Access.SSOExtension => <SOExtension bundleID=com.iru.Access.SSOExtension,
      path=/Applications/Iru Access.app/Contents/PlugIns/SSOExtension.appex>
    ```

    Any other single sign-on extensions installed on the Mac appear in the same list;
    the one that matters here is `com.iru.Access.SSOExtension`.
  </Step>

  <Step title="Watch approvals and sign-in activity live">
    Two live streams help when an approval is slow to land, or when a sign-in is not
    being intercepted.

    **Associated-domain checks:** watch macOS schedule and record domain approvals:

    ```bash theme={null}
    sudo swcutil watch --verbose
    ```

    **The SSO agent:** watch the process that runs the extension during sign-in:

    ```bash theme={null}
    sudo log stream --debug --process AppSSOAgent
    ```

    When the associated domains are **not** yet approved, the agent logs messages like
    these, which point straight at the cause:

    ```
    com.iru.Access.SSOExtension hasAssociatedDomainsApproved = 0

    Associated domain: validation failed for the SSO extension
    com.iru.Access.SSOExtension because it has no approved associated domains; it will
    be checked again when the extension is next used.
    ```

    `hasAssociatedDomainsApproved = 0` means the domains are not approved yet. Once
    approval lands, these errors stop and sign-ins to your Iru domains are intercepted
    by Iru Access.
  </Step>
</Steps>

## Common causes and fixes

| Symptom                                                  | Likely cause                                                           | Fix                                                                                                                                    |
| -------------------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| No `authsrv` entry in `swcutil show`                     | The Associated Domains payload did not reach the Mac                   | Re-deploy the Iru Access configuration profile from your MDM and confirm it is scoped to the device.                                   |
| Entry present but `Site/Fmwk Approval` is not `approved` | macOS has not validated the domain association, or the domain is wrong | Confirm the domain matches your Iru domain exactly, ensure the Mac can reach it over the network, then trigger a sign-in and re-check. |
| `Flags` missing `enterpriseManaged`                      | The domains were not pushed by MDM                                     | Use the MDM-delivered profile (managed deployment) rather than a hand-built one.                                                       |
| `hasAssociatedDomainsApproved = 0` in AppSSOAgent        | Domains not approved                                                   | Resolve the associated-domain approval above. macOS re-checks periodically and when the extension is next used.                        |
| Extension missing from `pluginkit -v -m`                 | Iru Access not installed, or never launched                            | Deploy the app and launch it once so the extension registers.                                                                          |

<Tip>
  After fixing a profile, approvals do not always refresh instantly. Trigger a
  sign-in to one of your Iru domains to prompt macOS to re-check, then re-run
  `sudo swcutil show`.
</Tip>

## Where to go next

<CardGroup cols={2}>
  <Card title="Deploy Iru Access" icon="arrow-up-from-bracket" href="/en/identity/authentication/deploy-iru-access">
    Set up the configuration profile, the app, and registration.
  </Card>

  <Card title="MDM connections" icon="tower-broadcast" href="/en/identity/authentication/mdm-connections">
    The connection that pushes the profile and makes a device count as managed.
  </Card>

  <Card title="Device trust" icon="laptop" href="/en/identity/authentication/device-trust">
    Require managed, healthy devices as a condition of access.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    How Iru Access fits alongside passkeys as an authenticator.
  </Card>
</CardGroup>