Configuring an iOS App as an Identity Provider

Convert an Existing Mobile SDK iOS App into an Identity Provider

To convert an existing Mobile SDK 11.x (or newer) iOS app into an identity provider:

1. In the SalesforceSDKManager, set isIdentityProvider to true.
2. In your AppDelegate class implementation, find the following method and reinstate the commented code as follows:

   Swift

   1func application(_ app: UIApplication, 
   2              open url: URL, 
   3               options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
   4    return UserAccountManager.shared.handleIdentityProviderCommand(
   5        from: url, with: options)
   6}

   Objective-C

   1- (BOOL)application:(UIApplication *)app 
   2            openURL:(NSURL *)url
   3            options:(NSDictionary<UIApplicationOpenURLOptionsKey,id>*)options {
   4
   5    return [[SFUserAccountManager sharedInstance] 
   6        handleIDPAuthenticationResponse:url options:options];
   7}

3. Add your custom URI scheme to the info.plist configuration. For example, the following XML defines “sampleidpapp” as a custom URI scheme:
   1<key>CFBundleURLTypes</key>
   2<array>
   3    <dict>
   4        <key>CFBundleURLSchemes</key>
   5        <array>
   6            <string>sampleidpapp</string>
   7        </array>
   8    </dict>
   9</array>

(Optional) Configure Keychain for your IDP Flow

For IDP-initiated login, you can use a shared keychain group to communicate between IDP and IDP client apps, which reduces the number of times a user has to switch between apps.

1. Add a keychain group in the “Keychain Sharing” section of your Xcode project configuration.
   If you’ve already configured an app group, you can use the keychain group automatically generated from the app group.

   The keychain you use for IDP and the keychain you use for other Mobile SDK operations can be set independently.

   Note

2. If you configure the app under the keychain group and want to share only the IDP token without the rest of the keychain items, set KeychainHelper.accessGroup to the app’s private keychain access group. Otherwise, the app defaults to the first keychain group in the list.

(Optional) Configure Your IDP App to Use Keychain

1. On the IDP app, go to the SalesforceSDKManager and set isIdentityProvider to true.
2. Initiate the flow in SFUserAccountManager by using this method.
   1- (void)kickOffIDPInitiatedLoginFlowForSP:(SFSDKSPConfig *)config
   2statusUpdate:(void(^)(SFSPLoginStatus))statusBlock
   3failure:(void(^)(SFSPLoginError))failureBlock;

(Optional) Customizing the Identity Provider UI

1@protocol SFSDKUserSelectionViewDelegate
2- (void)createNewUser:(NSDictionary *)spAppOptions;
3- (void)selectedUser:(SFUserAccount *)user 
4        spAppContext:(NSDictionary *)spAppOptions;
5- (void)cancel();
6
7@protocol SFSDKUserSelectionView<NSObject>
8    @property (nonatomic,weak) id<SFSDKUserSelectionViewDelegate> userSelectionDelegate;
9    @property (nonatomic,strong) NSDictionary *spAppOptions;
10@end

In identity provider client apps, Mobile SDK sets up an instance of the userSelectionDelegate and spAppOptions properties defined in the SFSDKUserSelectionView protocol. You use these objects in your identity provider’s view controller to notify Mobile SDK of the user’s user account selection. For example, assume that you’ve implemented the SFSDKUserSelectionView protocol in a UIViewController class named UserSelectionViewController. You can then use that view controller as the user selection dialog box by setting the idpUserSelectionBlock on the SalesforceSDKManager shared instance, as follows:

1//optional : Customize the User Selection Screen
2[SalesforceSDKManager sharedManager].idpUserSelectionBlock = 
3    ^UIViewController<SFSDKUserSelectionView> *{
4        UserSelectionViewController *controller = 
5            [[UserSelectionViewController alloc] init];
6        return controller;
7}