# Configure Extensible SSO on iOS devices

Extensible Single Sign-On (SSO) facilitates a seamless authentication process, allowing users to access enterprise applications and websites without repeated login prompts. This feature integrates SSO extensions from third-party Identity Providers (IdPs) like Okta or Microsoft Entra ID, as well as Apple’s built-in Kerberos extension.

1. Prerequisites
----------------

- **Device Version:** iOS 13 or later.
- **Identity Provider App:** The third-party IdP app providing the extension must be installed and managed on the device.

2. Configuration Workflow
-------------------------

1. Log in to the **Hexnode UEM portal**.
2. Navigate to **Policies > New Policy > Create a fully custom policy > iOS > Security > Extensible SSO** and click **Configure**.
3. Select the **SSO Extension Type**. The Hexnode portal offers three primary extension types:
**Type****Technical Use Case****Credential**Utilized for challenge/response authentication scenarios.**Redirect**Utilized for modern protocols such as OAuth, SAML 2.0, or OpenID Connect.**Kerberos**Apple’s built-in extension for environments supporting Kerberos authentication.5. Specify the **Extension Identifier:** This is the bundle identifier for the app extension (e.g., com.okta.mobile.auth-service-extension).

3. Technical Configuration Parameters
-------------------------------------

### Credential & Redirect Parameters

- **Realm:** The authentication realm. Value must be in UPPER-CASE.
- **SSO blocklist (iOS 15+):** Bundle identifiers of apps excluded from using SSO.
- **Hosts:** Specific domains or hostnames the extension can authenticate.
- **Lock screen behavior:** 
    - Cancel authentication requests: Requests terminate if the device is locked.
    - Do not handle authentication requests: Requests proceed without SSO when locked.

### Redirect Extension Parameters

- **URL:** The URL of the Identity Provider where the extension performs SSO.
- **SSO blocklist (iOS 15+):** Bundle identifiers of apps excluded from using SSO.
- **Lock screen behavior:**
    - Cancel authentication requests: Requests terminate if the device is locked.
    - Do not handle authentication requests: Requests proceed without SSO when locked.
    
    ### Kerberos Extension Parameters
    
    
    - **Realm:** The Active Directory domain for user accounts. Value must be in UPPER-CASE.
    - **Hosts:** Domains or hostnames authenticated by the extension.
    - **Allow saving password in Keychain Access:** Enables password storage in the device’s secure Keychain.
    
    4. Custom Configuration
    -----------------------
    
    Administrators can upload a file containing specific **key-value pairs** required by the SSO extension provider. The file must be in .plist format. This is necessary for advanced settings not covered by standard MDM fields.
    
    5. Policy Deployment
    --------------------
    
    
    1. Navigate to **Policy Targets** in the Hexnode portal.
    2. Select the desired **Devices, Users,** or **Groups.**
    3. Click **Save.**
    
    6. Troubleshooting & FAQs
    -----------------------------
    
    FAQs
    ----
    
    
    1. **Does this work with unmanaged apps?** SSO extensions generally function for managed apps and websites visited in Safari, provided they match the configured hosts or URLs.
    2. **Can multiple SSO policies be active?** While multiple policies can be pushed, only one extension can handle a specific authentication challenge based on the domain or URL match.
    3. **Is a third-party app required for Kerberos?** No. The Kerberos extension is natively included in iOS and does not require a separate IdP app.
    
    Troubleshooting
    ---------------
    
    
    - **SSO Not Triggering:** Confirm the **Extension Identifier** exactly matches the bundle ID of the installed extension app.
    - **Authentication Failures:** Verify the Realm is entered in ALL CAPS.
    - **Lock Screen Issues:** Adjust the Lock screen behavior to “Do not handle” if users must authenticate while the device is locked.