Modify the configuration of a Extensible SSO payload item within a profile

To modify Mac Extensible SSO policy payload item

Endpoints

put /api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}

Copy full URL

Request URL

https://{server-hostname}:8383/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}

Scope

MDMDeviceMgmt.UPDATECopied!

Header

Authorization: d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory

application/jsonCopied!

AcceptstringMandatory

application/jsonCopied!

- Path Parameters

profile_idstringMandatory

Unique identifier of the profile. Obtain from the Create Profile or Get Profiles response

payload_idstringMandatory

Unique identifier of the payload item. Obtain from the Get Payload Item IDs response

- Request Body

application/json

JSON Object

Hide Sub-Attributes

extension_identifierstringMandatory

Bundle identifier of the app extension that provides Single Sign-On (e.g., com.apple.AppSSOKerberos.KerberosExtension)

team_identifierstringMandatory

Apple Developer Team identifier of the app extension

typeintegerMandatory

SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect

realmstringMandatory

Kerberos realm name (e.g., ZYLKER.COM). Required when type is 0 (Credential), must be empty when type is 1 (Redirect)

authentication_methodintegerMandatory

Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key

screen_locked_behaviorintegerMandatory

Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle

extension_datastringMandatory

Custom configuration data for the SSO extension in Apple property list XML format

registration_tokenstringMandatory

Token used for Platform SSO registration. When provided, authentication_method must also be configured

hosts_and_urlsarrayMandatory

List of identity provider URL prefixes that the SSO extension handles (at least one required)

denied_apps_detailsJSON ArrayMandatory

List of apps excluded from using this SSO extension. Each item requires an app_group_id

Show Sub-Attributes

JSON Object

Show Sub-Attributes

app_group_idlongOptional

App group ID of the denied app. Obtain the app_group_id by adding the app via the Add App to Blocklist Repository API or from the Get Apps Available for Blocklisting API response

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request PUT \
  --url https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id} \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"authentication_method":-1,"hosts_and_urls":["https://login.zylker.com"],"extension_identifier":"com.apple.AppSSOKerberos.KerberosExtension","screen_locked_behavior":-1,"extension_data":"<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>","team_identifier":"apple","realm":"ZYLKER.COM","registration_token":"","type":0,"denied_apps_details":[{"app_group_id":9007199254741072}]}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}"))
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .header("Authorization", " d92d4xxxxxxxxxxxxx15f52")
        .method("PUT", HttpRequest.BodyPublishers.ofString("{\"authentication_method\":-1,\"hosts_and_urls\":[\"https://login.zylker.com\"],\"extension_identifier\":\"com.apple.AppSSOKerberos.KerberosExtension\",\"screen_locked_behavior\":-1,\"extension_data\":\"helpURLhttps://zylker.com/help\",\"team_identifier\":\"apple\",\"realm\":\"ZYLKER.COM\",\"registration_token\":\"\",\"type\":0,\"denied_apps_details\":[{\"app_group_id\":9007199254741072}]}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"authentication_method\":-1,\"hosts_and_urls\":[\"https://login.zylker.com\"],\"extension_identifier\":\"com.apple.AppSSOKerberos.KerberosExtension\",\"screen_locked_behavior\":-1,\"extension_data\":\"helpURLhttps://zylker.com/help\",\"team_identifier\":\"apple\",\"realm\":\"ZYLKER.COM\",\"registration_token\":\"\",\"type\":0,\"denied_apps_details\":[{\"app_group_id\":9007199254741072}]}"

headers = {
    'Content-Type': "application/json",
    'Accept': "application/json",
    'Authorization': " d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("PUT", "/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();
    data.put("extension_identifier","value");
    data.put("team_identifier","value");
    data.put("type","1");
    data.put("realm","value");
    data.put("authentication_method","1");
    data.put("screen_locked_behavior","1");
    data.put("extension_data","value");
    data.put("registration_token","value");
    data_hosts_and_urls=List();
    data.put("hosts_and_urls",data_hosts_and_urls);
    data_denied_apps_details=List();
    data_denied_apps_details_item1=Map();
    data_denied_apps_details_item1.put("app_group_id","1");
    data_denied_apps_details.add(data_denied_apps_details_item1);
    data.put("denied_apps_details",data_denied_apps_details);

    response = invokeUrl
    [
        url: "https://appDomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}"
        type: PUT
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", " d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/{profile_id}/payloads/macextensiblessopolicy/payloaditems/{payload_id}' -Method PUT -Headers $headers -ContentType 'application/json' -Body '{"authentication_method":-1,"hosts_and_urls":["https://login.zylker.com"],"extension_identifier":"com.apple.AppSSOKerberos.KerberosExtension","screen_locked_behavior":-1,"extension_data":"helpURLhttps://zylker.com/help","team_identifier":"apple","realm":"ZYLKER.COM","registration_token":"","type":0,"denied_apps_details":[{"app_group_id":9007199254741072}]}'

Sample Request Body

Modify Extensible SSO payload item

Copied!

  {
    "authentication_method": -1,
    "hosts_and_urls": [
      "https://login.zylker.com"
    ],
    "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
    "screen_locked_behavior": -1,
    "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
    "team_identifier": "apple",
    "realm": "ZYLKER.COM",
    "registration_token": "",
    "type": 0,
    "denied_apps_details": [
      {
        "app_group_id": 9007199254741072
      }
    ]
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

payload_idlong

Unique identifier of the payload item

extension_identifierstring

Bundle identifier of the app extension that provides Single Sign-On

team_identifierstring

Apple Developer Team identifier of the app extension

typeinteger

SSO extension type. Allowed values: 0=Credential (Kerberos), 1=Redirect

realmstring

Kerberos realm name. Empty when type is 1 (Redirect)

authentication_methodinteger

Authentication method for Platform SSO. Allowed values: -1=Not Configured, 0=Password, 1=User Secure Enclave Key

screen_locked_behaviorinteger

Behavior when SSO is requested while the screen is locked. Allowed values: -1=Not Configured, 0=Cancel, 1=Do Not Handle

extension_datastring

Custom configuration data for the SSO extension in Apple property list XML format

registration_tokenstring

Token used for Platform SSO registration

hosts_and_urlsarray

List of identity provider URL prefixes that the SSO extension handles

denied_apps_detailsJSON Array

List of apps excluded from using this SSO extension, with resolved app details

Show Sub-Attributes

JSON Object

Show Sub-Attributes

app_group_idlong

App group ID of the denied app

identifierstring

Bundle identifier of the denied app

group_display_namestring

Display name of the denied app

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Extensible SSO payload item successfully modified

Copied!

  {
    "authentication_method": -1,
    "hosts_and_urls": [
      "https://login.zylker.com"
    ],
    "extension_identifier": "com.apple.AppSSOKerberos.KerberosExtension",
    "payload_id": 9007199254741000,
    "screen_locked_behavior": -1,
    "extension_data": "<dict><key>helpURL</key><string>https://zylker.com/help</string></dict>",
    "team_identifier": "apple",
    "realm": "ZYLKER.COM",
    "registration_token": "",
    "type": 0,
    "denied_apps_details": [
      {
        "identifier": "com.zylker.deniedapp",
        "group_display_name": "Denied App",
        "app_group_id": 9007199254741072
      }
    ]
  }

▼ Show full

Duration: 1 minute | Threshold: 60 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.