Single Sign-On Configuration

Enter a name that identifies this configuration.

Enter the Kerberos principal name.

For iOS 8 with Gold license: Select the certificate to use to renew the Kerberos credential.

Enter a name that identifies this configuration.

Select one of the following SSO types:

• Credentials

  • Enter one or more Host names or domain names that can be authenticated through the app extension. Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique. Hosts that begin with a “.” are wildcard suffixes and will match all subdomains, otherwise the host must be an exact match.

  • Enter the Realm name. This value should be properly capitalized.

• Redirect

  • Enter one or more URL prefixes of identity providers where the app extension performs SSO. The URLs must begin with http:// or https://, the scheme and host name are matched case-insensitively, query parameters and URL fragments are not allowed, and the URLs of all installed Extensible SSO payloads must be unique.

The team identifier of the app extension.

This key is required on macOS and ignored elsewhere.

• Password

• User Secure Enclave Key

Select one of the following options:

• Cancel: The system cancels authentication requests when the screen is locked.

• Do Not Handle: The authentication request continues without SSO when the screen is locked.

Enter a name for the account that displays in notifications and authentication requests.

Enter the name of the group that has administrator access.

Enter the authorization right for a group name.

Select the checkbox to enable the creation of new users during login by using a password or smart card as an authentication method.

Select one of the authorization modes for a new user from the drop-down list:

• Standard: The account is for a standard user.

• Admin: The system adds the account to the local administrator’s group.

• Groups: The system automatically groups the new user under the administrator group, authorization group, or additional group.

Select one of the authorization modes for a user from the drop-down list:

• Standard: The account is for a standard user.

• Admin: The system adds the account to the local administrator’s group.

• Groups: The system automatically groups the new user under the administrator group, authorization group, or additional group.

Enable the policy to view the following settings:

• Attempt Authentication

• Require Authentication

  Select the Require Authentication checkbox to enable additional configuration settings.

• Allow Offline Grace Period

• Allow Authentication Grace Period

Enable the policy to view the following settings:

• Attempt Authentication

• Require Authentication

  Select the Require Authentication checkbox to enable additional configuration settings.

• Allow Offline Grace Period

• Allow Authentication Grace Period

• Allow TouchID Or Watch For Unlock

Enter the amount of time after selecting one of the policies to use an offline local account password after a successful Platform SSO login.

If you select the Allow Offline Grace Period checkbox in one of the policies, it becomes a mandatory field.

Basic Settings

Enter a description that clarifies the purpose of this configuration.

Enter the Kerberos realm name.

List of URLs prefixes that must be matched in order to use this account for Kerberos authentication over HTTP.

If false, passwords are not allowed to be saved to the keychain.

By default, this option is enabled.

Enter the Generic Security Service (GSS) name of the Kerberos cache to use. This option is now deprecated.

This property specifies the default realm if there is more than one Kerberos extension configuration.

Enter the name of the Active Directory site the Kerberos extension should use.

Click + Add to add a list of bundle IDs allowed to access the Ticket Granting Ticket (TGT) for authentication.

If true, the Kerberos extension allows the standard Kerberos utilities including Ticket Viewer and klist to access the use the credential. Available in macOS 12 and later.

Enter the text to be displayed to the user at the bottom of the Kerberos login window. It can be used to display help information or disclaimer text. This option is applicable to iOS 14 and macOS 11 through the latest version as supported by Ivanti Neurons for MDM.

Add Preferred Key Distribution Centers.

Click +Add to add a preferred KDC.

Perform Kerberos Only - If True, the Kerberos extension handles Kerberos requests only. Available in macOS 13 and later.

If True, allows the user to switch the user interface to Password mode. Available in macOS 15 and later.

If True, the user interface starts in SmartCard mode. Available in macOS 15 and later.

Enter the URL to be launched in the user’s default web browser when they initiate a password change. This option is applicable to macOS 10.15 through the latest version as supported by Ivanti Neurons for MDM.

Enter the minimum length (in characters) of passwords on the domain. This option is applicable to macOS 10.15 through the latest version as supported by Ivanti Neurons for MDM.

Enter the number of days that passwords can be used on this domain. For most domains, this can be calculated automatically. This option is applicable to macOS 10.15 through the latest version as supported by Ivanti Neurons for MDM. (This option is now deprecated)

Enter the number of prior passwords that cannot be re-used on this domain. This option is applicable to macOS 10.15 through the latest version as supported by Ivanti Neurons for MDM.

If false, disables password sync.

This will not work if the user is logged in with a mobile account. This option is applicable to macOS 10.15 through the latest version as supported by Ivanti Neurons for MDM.