iOS 12 Enterprise Single Sign-On Authentication Guide

Apple's iOS 12 streamlines enterprise single sign-on (SSO) by utilizing built-in Kerberos network authentication and dedicated API frameworks managed through Mobile Device Management (MDM). By allowing administrators to push centralized authentication payloads directly to managed devices, iOS 12 enables users to authenticate once with corporate credentials and securely access protected enterprise apps, internal intranets, and cloud services without repeatedly entering their passwords.

Kerberos MDM Payloads

The core of native SSO in iOS 12 is the Kerberos authentication extension managed via MDM profiles. Enterprise administrators configure a Single Sign-On payload containing specific configuration parameters:

  • Realm Name: The Active Directory or Kerberos realm (e.g., CORP.EXAMPLE.COM).
  • URL Prefixes: The fully qualified domain names and internal web paths that require Kerberos authentication.
  • App Identifiers: The bundle identifiers of approved enterprise applications allowed to use the Kerberos ticket.

Once installed on a supervised or enrolled device, the operating system intercepts network requests directed at the defined corporate URLs and automatically handles identity negotiation.

Ticket-Granting Process

When a user initiates access to a protected enterprise resource or opens a whitelisted enterprise app, iOS 12 performs the authentication exchange automatically:

  1. Credential Prompt: If a valid session does not exist, iOS presents a system-level prompt asking for enterprise credentials.
  2. TGT Retrieval: The device contacts the enterprise Key Distribution Center (KDC) over the internal network or an active VPN connection to acquire a Ticket Granting Ticket (TGT).
  3. Service Ticket Generation: When an app attempts to connect to an internal server or service, iOS 12 uses the active TGT to automatically request a service ticket, silently authenticating the user.
  4. Credential Caching: Tickets are held securely in memory and renewed in the background based on enterprise expiration policies, eliminating future password prompts while the ticket remains valid.

ASWebAuthenticationSession for Web and Cloud SSO

For modern identity providers using OAuth 2.0, SAML, or OpenID Connect, iOS 12 introduced the ASWebAuthenticationSession API. This API replaced the legacy SFAuthenticationSession and improved enterprise security for web-based logins:

  • Shared Authentication State: It allows enterprise apps to share cookies and authentication tokens with Safari, ensuring a true single sign-on experience between the mobile browser and native enterprise software.
  • User Consent and Privacy: The framework displays a system modal prompting the user to confirm they want to sign in using the designated identity provider domain, safeguarding credentials from third-party application access.
  • Ephemeral Sessions: Administrators and developers can choose between persistent sessions (for continuous SSO) or ephemeral sessions that clear cookies immediately after the authentication flow finishes.

App Sandboxing and Token Security

iOS 12 isolates enterprise credentials through the OS-level credential store. Third-party applications do not receive or store the user’s actual enterprise password; instead, they receive temporary access tokens or Kerberos service tickets managed strictly by the operating system. If a device is unenrolled from MDM or retired, the single sign-on payloads and cached enterprise credentials are removed immediately without compromising the user's personal data.