Installing Manually

For testing and pilot purposes you can install the HYPR Workforce Access Client application manually for each user. However, for deploying to larger segments of your workforce population you’ll want to integrate with a configuration management solution such as Microsoft Endpoint Configuration Manager (formerly SCCM) or Jamf on macOS.

This page describes the available installation parameters and shows how to run the installer from the command line for compatibility with configuration management tools.

Installation Parameters

For both Windows and macOS, the HYPR installer reads its configuration parameters from the hypr.json file located in the same directory as the installer. For Windows, you can also pass the parameters directly on the command line.

📘

All Right

If your downloaded install package already includes a hypr.json file, be cautious about changing any of the preconfigured values. This is how HYPR provides the necessary custom parameters for your installation.

The `hypr.json file is a simple collection of name-value pairs, each defining a single install parameter. For example:

{
  "version":"1.0",
  "rpUrl":"https://highlandsbank.hypr.com/rp",
  "appId":"HighlandsBankWeb",
  "pinningHash":"LeM8XnCIy8+Cxm+HKTEOBZr1g3D8odQNHTH+vdu7RWc=5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w=",
  "installToken":"0f03f635-4d9a-46ff-b537-cd97ad77cb6e",
  "certTemplate": "hyprwin",
  "securityKeyCertTemplate": ""
  "supportEmail":"[email protected]",
  "fullUI":"1"
}

The available parameters are as follows:

Command Line Installation for Windows

You can use the msiexec command to deploy the HYPR Workforce Access Client for Windows without the displaying the installation UI. Note that if you’re doing this manually at the command line you’ll need to run from a command prompt that has administrative privileges.

You have two options for setting the necessary parameters:

Option 1

1. Define the installation parameters in a hypr.json configuration file located in the same folder as the Workforce Access .msi file. (See Installation Parameters above.)
2. Run msiexec without any parameters:

msiexec.exe /qn /i WorkforceAccess_x64.msi

Option 2

1. Pass the installation parameters directly to msiexec on the command line. For example:

msiexec.exe /qn /i WorkforceAccess_x64.msi HYPRAPPID="HighlandsBankWeb"
HYPRRP="https://highlandsbank.hypr.com/rp" HYPRSUPPORT="[email protected]" HYPRHASH="LeM
8XnCIy8+Cxm+HKTEOBZr1g3D8odQNHTH+vdu7RWc=,5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w="
HYPRINSTALLTOKEN="0f03f635-4d9a-46ff-b537-cd97ad77cb6e" HYPRSUPPORT="[email protected]"

HYPR Registry Keys

The installation process adds a HYPR key to the Windows Registry at the following location:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\HYPR Workforce Access

The contents of this registry key are required for normal functioning of the application and shouldn’t normally be changed post-install. However, for troubleshooting purposes HYPR Support may ask you to review or modify some of the values.

Terminal Installation for macOS

You can use the installer command to deploy the HYPR Workforce Access Client for macOS without displaying the installation UI. Note that if you’re doing this manually in a Terminal window you’ll need to use sudo to grant the necessary privileges.

1. Define the installation parameters in a hypr.json configuration file located in the same folder as the Workforce Access .pkg file. (See Installation Parameters above.)
2. Run the installer command as follows:

installer -pkg /path/to/WorkforceAccess-\<version\>-Installer.pkg -target /

3. The installer will prompt you for a password (if using sudo) and report on the status of the install. For example (replace with the HYPR version):

ghopper@MacBook-Pro ~ % sudo installer -pkg /Users/gracehopper/Desktop/WorkforceAccess-
[<version>]-Installer.pkg -target /
Password:
installer: Package name is WorkforceAccess-<version>-Installer
installer: Upgrading at base path /
installer: The upgrade was successful.
installer: The install requires restarting now.
ghopper@MacBook-Pro ~ %

4. Restart the workstation when finished.

HYPR Application .plist Keys

The installation process stores a number of key values in an application .plist file in the following location:

/Library/HYPR/HyprOneService.plist

These keys are required for normal functioning of the application and shouldn’t normally be changed post-install. However, for troubleshooting purposes HYPR Support may ask you to review or modify the values.

Configuration Parameters

Manual Configuration

1. In a terminal, use sudo to edit /Library/HYPR/HyprOneService.plist via an editor (vi, nano, etc.).
2. Modify the file according to your configuration. It will appear similar to this:

3. Update the ApplicationId, RelyingPartyUrl, RelyingPartyPins, and SupportEmail based on the current server configuration.

4. Reboot the computer to apply the changes.

Enterprise Deployment and Configuration

To deploy the HYPR Workforce Access Client in an enterprise, wrap a script around that installation package. The script installs the package and updates the HyprOneService.plist file of all affected users.

This can be achieved with a combination of the defaults and plutil commands.

Example

#! /bin/bash

PLIST_FILE=/Library/HYPR/HyprOneService.plist

# Install the HYPR Employee Access package.
installer -pkg EmployeeAccess-2.1-Installer.pkg

# Customize the configuration.
defaults write $PLIST_FILE ApplicationId "NAME OF YOUR APP IN CONTROL CENTER"
defaults write $PLIST_FILE RelyingPartyPins "<COMMA DELIMITED LIST OF PINS>"
defaults write $PLIST_FILE RelyingPartyUrl "https://CONTROL_CENTER_URL/rp"
defaults write $PLIST_FILE SupportEmail "SUPPORT EMAIL"

# Convert the configuration file to XML.
plutil -convert xml1 $PLIST_FILE

FileVault Configuration

Apple FileVault doesn't support the smart card authentication protocol, and it can only be unlocked with a user password. Still, there's an option to require HYPR authentication after the FileVault unlock to ensure that users are always using an MFA solution.

Disable the automatic login option of FileVault by executing the following command:

sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YES

If this is disabled, users will be required to authenticate with HYPR Mobile App after entering the FileVault password.