Identity Provider Apps

An identity provider setup consists of two primary components:

• An identity provider (IDP) is an ordinary Mobile SDK app that’s configured to manage Salesforce logins for one or more users on a single mobile device. This app serves as the broker between Mobile SDK apps on the device and the Salesforce authentication service. It tracks device users that have recently logged in and kicks off the authentication process when they return to the app.
• An identity provider client is an ordinary Mobile SDK app that’s configured to use an identity provider for logins. These apps are also called “service providers” or “SPs” because they provide the services that the user is trying to access. A traditional service provider gives the user one choice for authentication: the Salesforce login screen. An identity provider client, on the other hand, gives the user the choice of logging in through either the Salesforce login screen or a specific identity provider. With the identity provider option, an authorization request to the current active user in the IDP app is sent to a Salesforce authorization endpoint.

Typically, a single device hosts a single identity provider app, but this limitation is not enforced. A single device can host any number of identity provider client apps.

Several rules apply to identity provider apps and their clients. The following apply to the latest IDP and SP flows supported in Mobile SDK 11.0.

• They must be built with Mobile SDK 11.0 or later.
• They must be discrete apps. You can’t combine identity provider and identity provider client implementations in a single app.
• A client and the identity provider it delegates to must use different Salesforce connected apps with differing OAuth callback URIs.