BlueFletch Launcher for Windows

The BlueFletch Launcher for Windows brings the BlueFletch shared-device experience to Windows. It replaces the default Windows Explorer shell with a secure, kiosk-style desktop that gives users immediate access to the applications they need and nothing else.

After a device boots, the Launcher takes over the shell, allows the user to authenticate against the company's identity provider, and presents a themed desktop and taskbar containing only the applications permitted by the user's directory groups.

• Frictionless Login Experience: Eliminate the need to type usernames and passwords on shared workstations. Users tap an NFC badge, enter a short PIN, and are signed in to the identity provider automatically.

• Enterprise Identity Integration: Authenticate with Microsoft Entra ID (Azure AD), Okta, or any OIDC-compliant provider using OAuth 2.0 with PKCE.

• Role-Based Desktops: Desktop layouts are driven by identity provider group membership, so associates, managers, and administrators each see exactly the applications assigned to their role.

• Locked-Down Shell: The Launcher runs as the Windows shell via Shell Launcher (Assigned Access) or a Winlogon shell override. Alt+Tab is blocked outside an authenticated session, the application menu is removed, and users cannot reach the underlying desktop.

• Walk-Up (Open Zone) Mode: Optionally present a limited default desktop with no login required, letting anyone use walk-up applications while still offering a Sign In button or badge tap for full access.

• Session Safety: Automatic inactivity lock or logout, PIN re-authentication, full browser session cleanup at logout, and window teardown ensure the next user never inherits the previous user's session.

How It Works

1. Windows boots and automatically starts the BlueFletch Launcher as the shell (optionally with auto-logon if configured during installation).

2. The Launcher reads its configuration from C:\ProgramData\BlueFletch\launcher.json, validates it against a schema, and verifies the license.

3. The user signs in - either through a browser-based identity provider login or by tapping an NFC badge and entering a PIN.

4. The Launcher resolves the user's directory groups to the configured desktop layouts and renders their desktop icons and taskbar.

5. Applications launch in a controlled environment; the taskbar tracks their windows and lets users switch between them.

6. On lock, logout, or inactivity, the Launcher clears the browser session, closes user windows, and returns to the login screen (or the Open Zone desktop).