Which common technology is Enterprise SSO (Single Sign-On) in iOS, iPadOS, and macOS based on?

Enterprise Single Sign-On (SSO) on iOS, iPadOS, and macOS is fundamentally based on the Kerberos network authentication protocol. Apple provides a built-in Kerberos extension that can be configured via a Mobile Device Management (MDM) profile. This extension intercepts authentication challenges from apps and websites, acquires a Kerberos ticket-granting ticket (TGT) from the organization's Key Distribution Center (KDC), and then uses it to seamlessly authenticate the user to various enterprise services without requiring repeated password entry. This framework provides a native, secure method for integrating Apple devices into traditional corporate network environments that rely on Kerberos, such as those using Active Directory.

B. Passkeys: Passkeys are a modern, passwordless authentication standard based on FIDO credentials. They are used for signing into apps and websites but are not the underlying technology for the traditional Enterprise SSO framework.

C. Gatekeeper: Gatekeeper is a macOS security feature that verifies the identity of developers and ensures software has not been tampered with. It is unrelated to user authentication or SSO protocols.

D. Keychain: Keychain is a secure database for storing sensitive user data like passwords, certificates, and keys. While the Kerberos extension uses the Keychain to store tickets, Keychain is the storage mechanism, not the SSO protocol itself.

1. Apple Platform Deployment Guide (February 13

2024): In the section "Use Kerberos single sign-on for Apple devices

" it states

"iOS

iPadOS

and macOS include a built-in client for Kerberos... The Kerberos SSO extension makes it easy to get and manage Kerberos tickets for your users." (See "Single sign-on" > "Use Kerberos single sign-on for Apple devices").

2. Apple Developer Documentation: The MDM payload documentation for Single Sign-On specifies the payload Type for the built-in extension. It explicitly lists Kerberos as the type. "The built-in Kerberos extension in iOS

iPadOS

and macOS requires this payload." (See "MDM" > "MDM Payloads" > "Single Sign-On").

3. MIT Information Systems & Technology (IS&T) Knowledge Base: University documentation for integrating macOS into their enterprise environment confirms the reliance on Kerberos. The article "Kerberos Extras for Mac OS X" details the use of the Kerberos framework on macOS for achieving SSO with MIT's network services. (Document: Kerberos for Macintosh

Section on SSO).