Extensible Single Sign-On

Enter a name that identifies this configuration.

Enter a description that clarifies the purpose of this configuration.

The Channel options are applicable to macOS only.

Select one of the following:

The User option is not supported on macOS 10.15 devices .

Select the initial sign on method.

If you select Credentials as the SSO Type, enter one or more host names or domain names that can be authenticated through the app extension.

Host or domain name matching is not case sensitive. The host and domain names must be unique. Hosts that begin with a “.” are wildcard suffixes. Wildcard suffixes will match all sub-domains. Otherwise, the host or domain name must be an exact match.

If you select Redirect as the SSO Type, enter one or more URL prefixes of identity providers where the app extension performs SSO.

The URLs must begin with http:// or https://. The scheme and host name matching is not case sensitive. Do not use query parameters and URL fragments. The URLs must be unique.

Enter the bundle ID of the app extension that performs the single sign-on for the specified URLs.

Enter the team identifier of the app extension.

The team identifier is required on macOS. However, it is ignored on iOS.

If you select Credentials as the SSO Type, enter the realm name.

The realm name is case sensitive and must be an exact match.

Enter one or more custom data as key-value pairs.

Select the checkbox to enable the 12 fields below.

Select the checkbox, the system uses the same signing and encryption keys for all users.

Select the checkbox to enable using identity provider accounts at authorization prompts. It requires that Use Shared Device Keys must be selected. The system assigns groups using AdministratorGroups, AdditionalGroups, or AuthorizationGroups.

Select the checkbox to enable creating new users at the login window with an Authentication Method of either Password or SmartCard. It requires that Use Shared Device Keys must be selected.

Enter the display name for the account in notifications and authentication requests.

Enter the list of created groups that don’t have administrator access.

Enter the list of groups to use for administrator access. The system requests membership during authentication.

The Platform SSO authentication method to use with the extension. It requires that the SSO Extension also support the method.

Possible Values: Password, UserSecureEnclaveKey, SmartCard

Enter authorization rights that are associated with group names. When the group is used, the system modifies the authorization right to use it.

The duration is in seconds until the system requires a full login instead of a refresh. The default value is 64,800 (18 hours). The minimum value is 3600 (1 hour).

Default: 64800

Minimum Value: 3600

Permission to apply to newly created accounts at login.

Allowed values:

Standard: The account is for a standard user.

Admin: The system adds the account to the local administrator group.

Groups: The system assigns groups to the account using AdministratorGroups, AdditionalGroups, or AuthorizationGroups.

The attribute mapping to use when creating new users or for authorization.

Select one of the authorization modes for a user from the drop-down list:

Enter the amount of time after selecting one of the policies to use unregistered local accounts.

Select one of the policies from the drop-down list:

Select one of the policies from the drop-down list:

Enter the list of usernames that are not subjected to FileVault, Login, or Unlock policies.

Enter the amount of time after selecting one of the policies to use an offline local account password after a successful Platform SSO login.

Select one of the policies from the drop-down list:

Select one of the following options: