Skip to main content
This Library Item is available for Apple devices

​
What is a Single Sign-On Extension?

A Single Sign-On (SSO) extension is a type of application for macOS, iOS, iPadOS, and visionOS that uses Apple’s Extensible Enterprise Single Sign-on framework. These applications, or extensions, let identity providers (IdPs) build applications that keep a user signed in across native macOS applications and browsers. This allows you to sign in once to the extension and be authenticated across macOS, iOS, iPadOS, and visionOS. SSO extensions can also allow for synchronizing a user’s local macOS password with their IdP password.
When deploying Okta Device Trust, this Single Sign-On Extension is not required separately because the functionality of the SSO Extension is included as part of the Okta Device Trust deployment.

​
How Can I Deploy a Single Sign-On Extension?

  • For iOS, iPadOS, and visionOS extensions, you must first deploy the app containing the SSO extension via Apps and Books from Apple Business or Apple School Manager.
  • For macOS extensions, you must first deploy the app containing the SSO extension via Apps and Books from Apple Business or Apple School Manager or via a Custom App in Iru.
  • After deploying the extension, you will then configure and deploy a Single Sign-On profile to the devices.

​
Configure a Single Sign-On Extension Profile

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.
1

Name the Library Item

Give the new Single Sign-On Extension Library Item a Name.
2

Assign to Blueprints

Assign to your desired Blueprints.

​
Redirect

1

Select Extension Type

Extension type is the type of sign-on authorization. Select Redirect.
2

Configure Extension Identifier

Extension identifier is the bundle identifier of the app extension that performs single sign-on. You can find it in the app’s info.plist file.
3

Set Team Identifier

Team identifier is the team identifier of the app extension that performs single sign-on. It is required when the Library Item is assigned to Mac computers, and it must be a 10-character alphanumeric string.
4

Configure URLs

URLs are the URL prefixes of the identity providers the extension signs in for. Select Add for each prefix.Query parameters and URL fragments are not allowed. Each URL must begin with http:// or https://, and it must be unique across the Single Sign-On Extension profiles installed on the device.
5

Set Denied Bundle Identifiers

Denied Bundle Identifiers are bundle identifiers of apps that should not use SSO from this extension. Select Add Bundle Identifier for each app. This applies to iOS 15 and later, iPadOS 15 and later, and macOS 12 and later.
6

Set Screen locked behavior

Screen locked behavior sets how the extension behaves when the screen is locked. The default is Not configured.
  • Not configured: Iru does not send this setting.
  • Cancel: Cancel authentication requests while the screen is locked.
  • Do not handle: Do not handle authentication requests while the screen is locked.
7

Configure Additional Extension Settings

Select Set additional extension configuration when the extension needs additional configuration data.
Platform SSO is available only for Redirect. After these extension settings, continue with Configure Platform Single Sign-On. For the other extension types, go to Credential or Kerberos.
If you plan to use OpenID, contact your identity provider to confirm that it supports OpenID with Platform SSO.

​
Credential

Platform SSO is not available for Credential.
1

Select Extension Type

For Extension type, select Credential.
2

Configure Extension Identifier

Extension identifier is the bundle identifier of the app extension that performs single sign-on. You can find it in the app’s info.plist file.
3

Set Team Identifier

Team identifier is the team identifier of the app extension that performs single sign-on. It is required when the Library Item is assigned to Mac computers, and it must be a 10-character alphanumeric string.
4

Set Realm

Realm is optional. Enter the properly capitalized realm name for the credential.
5

Set Hosts

Hosts are the domains or host names the extension can authenticate. Select Add for each name. Each name must be unique across the Single Sign-On Extension profiles installed on the device.
6

Set Denied Bundle Identifiers

Denied Bundle Identifiers are bundle identifiers of apps that should not use SSO from this extension. Select Add Bundle Identifier for each app. This applies to iOS 15 and later, iPadOS 15 and later, and macOS 12 and later.
7

Set Screen locked behavior

Screen locked behavior sets how the extension behaves when the screen is locked. The default is Not configured.
  • Not configured: Iru does not send this setting.
  • Cancel: Cancel authentication requests while the screen is locked.
  • Do not handle: Do not handle authentication requests while the screen is locked.
8

Set additional extension configuration

Select Set additional extension configuration to enter any other configuration data the extension requires.

​
Kerberos

Platform SSO is not available for Kerberos. Use these steps for Apple’s Kerberos extension.
1

Select Extension Type

For Extension type, select Kerberos.
2

Set Realm

Realm is required. Enter the properly capitalized realm name, such as the capitalized form of your Active Directory domain name. For example, accuhive.io becomes ACCUHIVE.IO.
3

Set Hosts

Hosts are the domains or host names the extension can authenticate. Select Add for each name. Each name must be unique across the Single Sign-On Extension profiles installed on the device.You can leave Hosts empty. If enterprise applications use AD FS, and AD FS accepts Kerberos authentication, add the AD FS host (for example, adfs.accuhive.io).
4

Set Screen locked behavior

Screen locked behavior sets how the extension behaves when the screen is locked. The default is Not configured.
  • Not configured: Iru does not send this setting.
  • Cancel: Cancel authentication requests while the screen is locked.
  • Do not handle: Do not handle authentication requests while the screen is locked.

​
Password Options

Select a checkbox to send that setting. Some checkboxes show a value to enter.
  • Disallow automatic login: Passwords are not saved to the keychain.
  • Disallow password change: Disables password changes. Available in macOS 10.15 and later.
  • Require complex passwords: Passwords must meet Active Directory’s definition of complex. Available in macOS 10.15 and later.
  • Password history: Enter how many prior passwords cannot be reused on this domain. Available in macOS 10.15 and later.
  • Password length: Enter the minimum password length, in characters, for this domain. Available in macOS 10.15 and later.
  • Sync password with local user: Use the Active Directory password as the local user password. This does not work when the user is logged in with a mobile account. Available in macOS 10.15 and later.
  • Change password URL: Enter the URL the extension opens during a password change. Available in macOS 10.15.4 and later.
  • Password expiration notification: Enter how many days before password expiration users start receiving notifications.
  • Minimum password age: Enter the minimum age, in days, before a password can be changed on this domain.

​
Advanced

Select a checkbox to send that setting. Some checkboxes show a value to enter.
  • Bundle ID access: Select Add for each bundle ID allowed to access the ticket-granting ticket (TGT).
  • Autofill username: Enter the principal name. Do not include the realm.
  • Default realm: Use this realm when more than one Kerberos extension configuration is installed.
  • Require user presence: The user must provide Touch ID, Face ID, or their passcode to access the keychain entry.
  • Site Code: Enter the Active Directory site the Kerberos extension should use. Most administrators can leave this unset. The extension can normally find the site automatically.
  • Disable Autodiscover for site name: The extension does not use LDAP and DNS to determine its Active Directory site name.
  • Custom Username Label: Enter the label shown instead of Username. For example, Company ID. Available in macOS 11 and later.
  • Delay User Setup: Do not prompt the user to set up the Kerberos extension until an administrator enables it with the app-sso tool, or until a Kerberos challenge is received. Available in macOS 11 and later.
  • Help Text: Enter the text shown at the bottom of the Kerberos login window, such as help information or a disclaimer. Available in iOS 14 and later and macOS 11 and later.
  • Include Managed Apps in Bundle ACL: Only managed apps can access and use the credential, in addition to any bundle IDs in Bundle ID access. Available in iOS 14 and later.
  • Disable Monitor Credentials Cache: The credential is requested on the next matching Kerberos challenge or network change. If the credential is expired or missing, a new one is created. Available in macOS 11 and later.
  • Disallow smart card: The user cannot switch the interface to smart card mode. Available in macOS 15 and later.
  • Disallow password: The user cannot switch the interface to password mode. Available in macOS 15 and later.
  • Start in smart card mode: The interface starts in smart card mode. Available in macOS 15 and later.
  • Smart Card Identity Issuer Auto Select Filter: Enter a string with wildcards to filter available smart cards by issuer. If one card remains, it is selected automatically. If more than one remains, the list is shorter.

Library Overview

Overview of the Iru Endpoint Library for managing apps, profiles, scripts, and configurations. Curate Library Items and assign them to device Blueprints.

Configuring Blueprints

Create and configure Blueprints in Iru Endpoint to group devices and assign management policies. Define Assignment Maps and Library Item assignments.

Configure Platform Single Sign-On

Configure Platform SSO in the Single Sign-On Extension Library Item. Set the authentication method, password policies, and macOS 26 and macOS 27 settings.