The account list will also be shared across application instances. That's it! The Microsoft identity SDK will now share credentials across all your applications. Sharing a keychain means that you must be very careful when your app uses Microsoft identity SDK remove operations. This is particularly impactful if you have applications that rely on tokens to do background work. When you share a keychain across your applications, any application can delete users or even all of the tokens across your application. Let application = try MSALPublicClientApplication(configuration: config) Swift: let config = MSALPublicClientApplicationConfig(clientId: '')Ĭ = 'my.oup' MSALPublicClientApplicationConfig *configuration = *application = initWithConfiguration:configuration error:&error] Once you have the keychain entitlement enabled in each of your applications, and you're ready to use SSO, configure MSALPublicClientApplication with your keychain access group as in the following example: on macOS.įor more information, see keychain groups.$(AppIdentifierPrefix)Īdd a new keychain group to your project Capabilities. When you have the entitlements set up correctly, you'll see a ist file in your project directory that contains something like this example: What is important is that you decide what you want your keychain to be called and add that capability to all of your applications that will be involved in SSO. Refer to Apple's Adding Capabilities article to enable keychain sharing. Setup keychain sharing between applications The format of redirect URIs must be compatible with the format MSAL supports, which is documented in MSAL Redirect URI format requirements. For example:Īpp1 Redirect URI: 1://authĪpp2 Redirect URI: 2://authĪpp3 Redirect URI: 3://auth Each app in your suite will have a different redirect URI. Each application can have multiple Redirect URIs registered in the onboarding portal. The way the Microsoft identity platform tells apps that use the same Application ID apart is by their Redirect URIs. This is the unique identifier that was provided to you when you registered your first application in the portal.

Use the same Client ID and Application IDįor the Microsoft identity platform to know which applications can share tokens, those applications need to share the same Client ID or Application ID.

Tell the MSAL SDKs about the shared keychain you want us to use if it's different from the default one.

Request the same keychain entitlement for each of your applications.Ensure that all of your applications share the same signing certificate from Apple so that you can share keychains.Ensure that all your applications use the same Client ID or Application ID.To enable SSO across your applications, you'll need to do the following steps, which are explained in more detail below: MSAL supports SSO sharing through iOS keychain access groups. See SSO between ADAL and MSAL apps on macOS and iOS for instructions for cross-app SSO between ADAL and MSAL-based apps. The apps must be distributed by the same Apple Developer. MSAL Objective-C supports migration and SSO with ADAL Objective-C-based apps. Silent SSO between ADAL and MSAL macOS/iOS apps.

MSAL on macOS only supports WKWebView which doesn't have SSO support with Safari. This type of SSO is currently not available on macOS.

Youtube paint on mac