Add a new Extensible SSO payload configuration to an existing profile

To create Mac Extensible SSO policy

Endpoints

post /api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy

Copy full URL

Request URL

https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy

Scope

MDMDeviceMgmt.CREATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory

application/jsonCopied!

AcceptstringMandatory

application/jsonCopied!

- Path Parameters

profile_idstringMandatory

Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response

- Request Body

application/json

JSON Object

Hide Sub-Attributes

extension_identifierstringMandatory

Bundle identifier of the app extension that provides Single Sign-On (e.g., com.apple.AppSSOKerberos.KerberosExtension)

team_identifierstringMandatory

Apple Developer Team identifier of the app extension

typeintegerMandatory

SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect

realmstringMandatory

Kerberos realm name (e.g., ZYLKER.COM). Required when type is 0 (Credential), must be empty when type is 1 (Redirect)

authentication_methodintegerMandatory

Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key

screen_locked_behaviorintegerMandatory

Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle

extension_datastringMandatory

Custom configuration data for the SSO extension in Apple property list XML format

registration_tokenstringMandatory

Token used for Platform SSO registration. When provided, authentication_method must also be configured

hosts_and_urlsarrayMandatory

List of identity provider URL prefixes that the SSO extension handles (at least one required)

denied_apps_detailsJSON ArrayMandatory

List of apps excluded from using this SSO extension. Each item requires an app_group_id

Show Sub-Attributes

JSON Object

Show Sub-Attributes

app_group_idlongOptional

App group ID of the denied app. Obtain the app_group_id by adding the app via the Add App to Blocklist Repository API or from the Get Apps Available for Blocklisting API response

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"authentication_method":-1,"hosts_and_urls":["https://login.zylker.com"],"extension_identifier":"com.apple.AppSSOKerberos.KerberosExtension","screen_locked_behavior":-1,"extension_data":"<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>","team_identifier":"apple","realm":"ZYLKER.COM","registration_token":"","type":0,"denied_apps_details":[{"app_group_id":9007199254741072}]}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy"))
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .header("Authorization", " d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"authentication_method\":-1,\"hosts_and_urls\":[\"https://login.zylker.com\"],\"extension_identifier\":\"com.apple.AppSSOKerberos.KerberosExtension\",\"screen_locked_behavior\":-1,\"extension_data\":\"helpURLhttps://zylker.com/help\",\"team_identifier\":\"apple\",\"realm\":\"ZYLKER.COM\",\"registration_token\":\"\",\"type\":0,\"denied_apps_details\":[{\"app_group_id\":9007199254741072}]}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"authentication_method\":-1,\"hosts_and_urls\":[\"https://login.zylker.com\"],\"extension_identifier\":\"com.apple.AppSSOKerberos.KerberosExtension\",\"screen_locked_behavior\":-1,\"extension_data\":\"helpURLhttps://zylker.com/help\",\"team_identifier\":\"apple\",\"realm\":\"ZYLKER.COM\",\"registration_token\":\"\",\"type\":0,\"denied_apps_details\":[{\"app_group_id\":9007199254741072}]}"

headers = {
    'Content-Type': "application/json",
    'Accept': "application/json",
    'Authorization': " d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();
    data.put("extension_identifier","value");
    data.put("team_identifier","value");
    data.put("type","1");
    data.put("realm","value");
    data.put("authentication_method","1");
    data.put("screen_locked_behavior","1");
    data.put("extension_data","value");
    data.put("registration_token","value");
    data_hosts_and_urls=List();
    data.put("hosts_and_urls",data_hosts_and_urls);
    data_denied_apps_details=List();
    data_denied_apps_details_item1=Map();
    data_denied_apps_details_item1.put("app_group_id","1");
    data_denied_apps_details.add(data_denied_apps_details_item1);
    data.put("denied_apps_details",data_denied_apps_details);

    response = invokeUrl
    [
        url: "https://appDomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy"
        type: POST
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", " d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy' -Method POST -Headers $headers -ContentType 'application/json' -Body '{"authentication_method":-1,"hosts_and_urls":["https://login.zylker.com"],"extension_identifier":"com.apple.AppSSOKerberos.KerberosExtension","screen_locked_behavior":-1,"extension_data":"helpURLhttps://zylker.com/help","team_identifier":"apple","realm":"ZYLKER.COM","registration_token":"","type":0,"denied_apps_details":[{"app_group_id":9007199254741072}]}'

Sample Request Body

Add Extensible SSO payload to the profile

Copied!

  {
    "authentication_method": -1,
    "hosts_and_urls": [
      "https://login.zylker.com"
    ],
    "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
    "screen_locked_behavior": -1,
    "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
    "team_identifier": "apple",
    "realm": "ZYLKER.COM",
    "registration_token": "",
    "type": 0,
    "denied_apps_details": [
      {
        "app_group_id": 9007199254741072
      }
    ]
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

payload_idlong

Unique identifier for the created payload item

extension_identifierstring

Bundle identifier of the app extension that provides Single Sign-On

team_identifierstring

Apple Developer Team identifier of the app extension

typeinteger

SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect

realmstring

Kerberos realm name. Empty when type is 1 (Redirect)

authentication_methodinteger

Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key

screen_locked_behaviorinteger

Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle

extension_datastring

Custom configuration data for the SSO extension in Apple property list XML format

registration_tokenstring

Token used for Platform SSO registration

hosts_and_urlsarray

List of identity provider URL prefixes that the SSO extension handles

denied_apps_detailsJSON Array

List of apps excluded from using this SSO extension, with resolved app details

Show Sub-Attributes

JSON Object

Show Sub-Attributes

app_group_idlong

App group ID of the denied app

identifierstring

Bundle identifier of the denied app

group_display_namestring

Display name of the denied app

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Extensible SSO payload successfully added

Copied!

  {
    "authentication_method": -1,
    "hosts_and_urls": [
      "https://login.zylker.com"
    ],
    "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
    "payload_id": 9007199254741000,
    "screen_locked_behavior": -1,
    "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
    "team_identifier": "apple",
    "realm": "ZYLKER.COM",
    "registration_token": "",
    "type": 0,
    "denied_apps_details": [
      {
        "identifier": "com.zylker.deniedapp",
        "group_display_name": "Denied App",
        "app_group_id": 9007199254741072
      }
    ]
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.