User Profile

Hi, In a managed environment, will apps/enterprise SSO extensions have access to digital identities installed at a system-wide level? I did try with ASWebAuthentication/Safari, both of them can pick the certificate but the SSO extension with URLSession cannot. Is there a challenge that needs to be handled? I did try with redirect extension. Also, a native app that is only deployed in the managed environment can have access to the digital identity that is installed at the system level? What are my options to do a certificate authentication? Thanks