Configuring Extensible Single Sign-On (iOS/ Shared iPad User)

Before you begin

Ensure the following:
  • You have Manage Profile permissions. See General Permissions.
  • Target devices are running iOS 13.0 or later.

About this task

This task explains how to configure the Extensible SSO payload with app extensions that enable SSO for supported iOS applications. It applies to both iOS and Shared iPad environments.

Procedure

  1. Create or edit a Reactive iOS/ Shared iPad User profile. See Creating a Profile and Editing a Profile.
  2. From the Security & Restrictions configurations list, add the Extensible SSO configuration.
    Note: For Shared iPad users, select Extensible Single Sign-On.
    Selecting the Extensible SSO profile configuration in a Reactive iOS profile.
  3. Enter the bundle identifier of the app extension that performs single sign-on for the specified URLs.
  4. Select the SSO type.
    • Redirect (recommended when using SOTI Identity).
    • Credential
  5. If you selected Credential:
    • Enter the required associated Kerberos Realm.
    • Select (Add) in the Add Host Names section to add host or domain names to authenticate through the app extension.
  6. If you selected Redirect:
    • Select (Add) to add URL prefixes of the identity providers that the app extension handles.
  7. Optional: Pass extra data to the app extension using a plist-formatted dictionary.
    Note: The data must begin and end with <dict> tags.

    Example 

    <dict>
<key>AllowedApps_BundleID</key>
<string>com.microsoft.skydrive,com.apple.mobilesafari,com.microsoft.azureauthenticator</string>
</dict>
  8. Save the configuration and assign the profile to your target devices. See Assigning a Profile.

Results

You have successfully configured Extensible SSO for your iOS and Shared iPad User devices. The profile is now visible in the Profiles view.