This Library Item is available for Apple devices
What is a Single Sign-On Extension?
A Single Sign-On (SSO) extension is a type of application for macOS, iOS, iPadOS, and visionOS that uses Apple’s Extensible Enterprise Single Sign-on framework. These applications, or extensions, let identity providers (IdPs) build applications that allow for a seamless SSO experience across native macOS applications and browsers. This allows you to sign in once to the extension and be authenticated across macOS, iOS, iPadOS, and visionOS. SSO extensions can also allow for synchronizing a user’s local macOS password with their IdP password.How Can I Deploy a Single Sign-On Extension?
- For iOS, iPadOS, and visionOS extensions, you must first deploy the app containing the SSO extension via Apps and Books from Apple Business or Apple School Manager.
- For macOS extensions, you must first deploy the app containing the SSO extension via Apps and Books from Apple Business or Apple School Manager or via a Custom App in Iru.
- After deploying the extension, you will then configure and deploy a Single Sign-On profile to the devices.
Configure a Single Sign-On Extension Profile
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.1
Name the Library Item
Give the new Single Sign-On Extension Library Item a Name.
2
Assign to Blueprints
Assign to your desired Blueprints.
Redirect Single Sign-On Extension Profile
1
Select Extension Type
Extension Type: This option refers to the type of SSO extension. Choose Redirect from the drop-down menu.
2
Configure Extension Identifier
Extension Identifier: In this option, you specify the Bundle ID of the SSO extension. The Bundle ID can be found by inspecting the app’s info.plist file.
3
Set Team Identifier
Team Identifier: The team identifier of the app extension that performs single sign-on. Required if the extension will be assigned to Mac computers.
4
Configure URLs
URLs: This option allows you to specify the URL prefix on behalf of which the SSO extension will authenticate.
5
Set Denied Bundle Identifiers
Denied Bundle Identifiers: Specify bundle identifiers of apps that shouldn’t use SSO provided by this extension. Applies to iOS and iPadOS 15 and later, and macOS 12 and later.
6
Configure Additional Extension Settings
Set additional extension configuration: Optionally specify any additional configuration data required by the extension.
Credential Single Sign-On Extension Profile
1
Select Extension Type
Extension type: This option refers to the type of SSO extension. Choose Credential from the drop-down menu.
2
Configure Extension Identifier
Extension Identifier: In this option, you specify the Bundle ID of the SSO extension. The Bundle ID can be found by inspecting the app’s info.plist file.
3
Set Team Identifier
Team Identifier: The team identifier of the app extension that performs single sign-on. Required if the extension will be assigned to Mac computers.
4
Configure Realm
Realm: This option will be displayed only if the credential type is Credential. Typically, this is in reference to a Kerberos realm when leveraging the Kerberos extension.
5
Set Hosts
Hosts: This option allows you to specify which host can be authenticated through the SSO extension. An example would be an ADFS instance.
6
Set Denied Bundle Identifiers
Denied Bundle Identifiers: Specify bundle identifiers of apps that shouldn’t use SSO provided by this extension. Applies to iOS and iPadOS 15 and later, and macOS 12 and later.
7
Configure Additional Extension Settings
Set additional extension configuration: Optionally specify any additional configuration data required by the extension.
Configure a Single Sign-On Extension Profile for Apple’s Kerberos Extension
1
Select Extension Type
Extension type: This option refers to the type of SSO extension. Choose Kerberos from the drop-down menu.
2
Configure Realm
Realm: Set the Realm to the capitalized form of your Active Directory domain name (i.e. accuhive.io becomes ACCUHIVE.IO)
3
Set Hosts
Hosts: This can be left empty. If you have enterprise applications leveraging ADFS, and ADFS is configured to accept Kerberos authentication, you can add the host to your ADFS server here. (i.e. adfs.accuhive.io)
4
Configure Password Options
Under the Password Options section, you can configure all of the available Kerberos extension options (such as syncing the local user password).
What is Platform SSO?
Platform SSO allows Single Sign-On Extensions to extend their functionality to the macOS login window. This lets users unlock their Mac using an IdP password and enables just-in-time creation of local accounts on a shared Mac using credentials from your organization’s Identity Provider (IdP). The local account password is automatically kept in sync, so the cloud password and local passwords match. Permissions and local group memberships can be managed, and this also extends to IdP users who don’t have a local account, so those credentials can be used at authorization prompts.Configure Platform SSO
If you selected Kerberos as the extension type, the Platform SSO section will be unavailable, as they are not complementary technologies.
1
Enable Platform SSO
The Platform SSO section is inactive by default. Toggle the radio button to expand and configure it:
2
Select authentication method
Select the authentication method. The SSO Extension must support this authentication method.
3
Enter Registration token (optional)
Optionally, enter your Registration token when your identity provider requires one. The Mac uses this value for Platform SSO registration with your identity provider, including silent registration when your identity provider and SSO extension support it.
4
Configure existing account permissions
Select the permissions group that existing local user accounts should have at login: Standard, administrator, or groups that will be specified in later steps.
5
Configure new account permissions
Select the permissions group that new accounts created at the login window should have.
6
Configure shared device settings
If you would like to allow account creation at the login window, which is helpful for shared devices, configure shared device key usage:
7
Enable shared device keys
Select Use shared device keys.
8
Allow authorization with IdP
Allow authorization (with identity provider account) will let users interact with system authorization prompts using their IdP credentials.
9
Enable automatic account creation
If you want to have local accounts created automatically for users, select Allow creation of new users at login window.
Login Options & Groups
1
Configure login options
Next, you’ll configure a few more login options:
- The account display name will typically be your organization’s name or something your users will recognize as it appears in notifications and authentication requests.
- A full login can be required after a certain amount of time. The default is 18 hours (64800 seconds), and the minimum value is 1 hour (3600 seconds).
- The attribute mapping to use when creating new users or for authorization.
2
Configure authorization groups
Finally, you can configure authorization groups which will let users or IT staff have specific permissions on the device. There are three different types of groups:
- Admin groups are groups from your IdP that should have administrator access on the device.
- Additional groups are ones you would like to see created in the device’s local directory.
- User groups are most useful: They let you map specific macOS systems rights to arbitrary groups that will be created in the local directory. For example, to grant ‘sudo’ or printer management access.
Enable Registration During Setup Assistant (macOS 26 and later)
Starting in macOS 26, Platform SSO can run during Setup Assistant so the Mac can register with your identity provider earlier in the enrollment flow. This section lets you configure registration during setup, first-user creation, profile picture sync behavior, and Authenticated Guest Mode for shared-device workflows.1
Open the Mac macOS 26 and later section
In the Platform SSO section of this Library Item, go to Mac macOS 26 and later.
2
Set Enable registration during Setup Assistant
Select Yes for Enable registration during Setup Assistant so Platform SSO registration runs while Setup Assistant is still in progress.
3
Set Create first user during Setup Assistant
For Create first user during Setup Assistant, select Yes when the Mac should create its first local account during Setup Assistant using Platform SSO. If your organization provisions the first account differently, adjust this setting to match that workflow.
4
Set Synchronize profile picture
Configure Synchronize profile picture based on whether the Mac should request the user’s login profile picture from the SSO extension during this setup flow.
5
Set Enable Authenticated Guest Mode
Configure Enable Authenticated Guest Mode when you deploy shared Macs where users sign in temporarily with IdP credentials and want Authenticated Guest Mode behavior. For standard single-user Macs, leave this behavior off.
6
Set New user authentication methods
Under New user authentication methods, select the authentication methods available for newly created accounts.
7
Save the Library Item
Click the Save button.
8
Install Platform SSO Library Items during Automated Device Enrollment
Platform SSO with Automated Device Enrollment requires your Single Sign-on Extension Library Item and the Auto App Library Item for your identity provider’s SSO extension application to install during Setup Assistant. In your Automated Device Enrollment Library Item, turn on Install Library Items during Setup Assistant for Mac, then add those Library Items plus any others your IdP requires for this flow (for example a Login Window Library Item). See Install Library Items during Setup Assistant for the full details. If a device is stuck on Configuring, see Manually release devices held in Setup Assistant.