Configuring an iOS App as an Identity Provider

You can configure any app built on Mobile SDK 11.0 or later as an identity provider. You configure it to identify itself as an identity provider, and Mobile SDK does the rest.

The easiest way to create an identity provider app is by using the Mobile SDK Mobile SDK iOSIDPTemplate. This template is available on GitHub in the github.com/forcedotcom/SalesforceMobileSDK-Templates repo. Use the forceios createwithtemplate command with the URI of the template repo, as shown in the following command-line example.

1$ forceios createwithtemplate
2Enter URI of repo containing template application: IOSIDPTemplate
3Enter your application name: MyIDP-iOS
4Enter your package name: com.acme.android
5Enter your organization name (Acme, Inc.): Acme Systems
6Enter output directory for your app (leave empty for the current directory): MyIDP-iOS

Convert an Existing Mobile SDK iOS App into an Identity Provider

To convert an existing Mobile SDK 11.x (or newer) iOS app into an identity provider:

In the SalesforceSDKManager, set isIdentityProvider to true.

In your AppDelegate class implementation, find the following method and reinstate the commented code as follows:

Swift

1func application(_ app: UIApplication,
2              open url: URL,
3               options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
4    return UserAccountManager.shared.handleIdentityProviderCommand(
5        from: url, with: options)
6}

Objective-C

1- (BOOL)application:(UIApplication *)app
2
3            openURL:(NSURL *)url
4            options:(NSDictionary<UIApplicationOpenURLOptionsKey,id>*)options {
5
6    return [[SFUserAccountManager sharedInstance]
7        handleIDPAuthenticationResponse:url options:options];
8}

Add your custom URI scheme to the info.plist configuration. For example, the following XML defines “sampleidpapp” as a custom URI scheme:

1<key>CFBundleURLTypes</key>
2<array>
3    <dict>
4        <key>CFBundleURLSchemes</key>
5        <array>
6            <string>sampleidpapp</string>
7        </array>
8    </dict>
9</array>

To convert an existing Mobile SDK 11.x (or newer) iOS app into an identity provider, go to the SalesforceSDKManager. Then:

Set isIdentityProvider to true.

In SFUserAccountManager, initiate the flow using the following method.

1- (void)kickOffIDPInitiatedLoginFlowForSP:(SFSDKSPConfig *)config
2                             statusUpdate:(void(^)(SFSPLoginStatus))statusBlock
3                                  failure:(void(^)(SFSPLoginError))failureBlock;

(Optional) Configure Keychain for your IDP Flow

For IDP-initiated login, you can use a shared keychain group to communicate between IDP and IDP client apps, which reduces the number of times a user has to switch between apps.

Add a keychain group in the “Keychain Sharing” section of your Xcode project configuration.

If you’ve already configured an app group, you can use the keychain group automatically generated from the app group.

The keychain you use for IDP and the keychain you use for other Mobile SDK operations can be set independently.
Note
If you configure the app under the keychain group and want to share only the IDP token without the rest of the keychain items, set KeychainHelper.accessGroup to the app’s private keychain access group. Otherwise, the app defaults to the first keychain group in the list.

(Optional) Configure Your IDP App to Use Keychain

On the IDP app, go to the SalesforceSDKManager and set isIdentityProvider to true.

Initiate the flow in SFUserAccountManager by using this method.

1- (void)kickOffIDPInitiatedLoginFlowForSP:(SFSDKSPConfig *)config
2statusUpdate:(void(^)(SFSPLoginStatus))statusBlock
3failure:(void(^)(SFSPLoginError))failureBlock;

(Optional) Customizing the Identity Provider UI

When a client app forwards a login request, the identity provider typically presents a selection dialog box. This dialog box, which lists known users, appears only if at least one of the following conditions is true:

A user has logged in from any other identity provider client app before this request.
A user has directly logged in to the identity provider app before this request.
Multiple users are currently logged in.

Note: If no users have logged in before this request, Mobile SDK displays a login screen and continues to authentication after the user successfully finishes the login flow.

Note

To customize the user selection view, an identity provider app extends the UIViewController class and must also implement the SFSDKUserSelectionView protocol.

1@protocol SFSDKUserSelectionViewDelegate
2- (void)createNewUser:(NSDictionary *)spAppOptions;
3- (void)selectedUser:(SFUserAccount *)user
4        spAppContext:(NSDictionary *)spAppOptions;
5- (void)cancel();
6
7@protocol SFSDKUserSelectionView<NSObject>
8    @property (nonatomic,weak) id<SFSDKUserSelectionViewDelegate> userSelectionDelegate;
9    @property (nonatomic,strong) NSDictionary *spAppOptions;
10@end

In identity provider client apps, Mobile SDK sets up an instance of the userSelectionDelegate and spAppOptions properties defined in the SFSDKUserSelectionView protocol. You use these objects in your identity provider’s view controller to notify Mobile SDK of the user’s user account selection. For example, assume that you’ve implemented the SFSDKUserSelectionView protocol in a UIViewController class named UserSelectionViewController. You can then use that view controller as the user selection dialog box by setting the idpUserSelectionBlock on the SalesforceSDKManager shared instance, as follows:

1//optional : Customize the User Selection Screen
2[SalesforceSDKManager sharedManager].idpUserSelectionBlock =
3    ^UIViewController<SFSDKUserSelectionView> *{
4        UserSelectionViewController *controller =
5            [[UserSelectionViewController alloc] init];
6        return controller;
7}

We've Moved

Welcome to the new home of the Mobile SDK Developer Guide! For now, the Japanese guide can be found in PDF form.