Questions on Platform SSO - Password grant Type Flow Implementations

Hi Apple Community,

Problem :

  1. Should be able to use my iDP password when I try to unlock my macOS local User Account.

  2. Password should sync across my macOS local User Account, when my User Account Password in iDP Changed

  3. Should have a provision to create a on-demand macOS local account with password of iDP
  4. Should be able to Create Primary Account in Automated Device Enrollment with password synced to iDP ( Simplified PSSO in Setup Assistant )

Solution :

These can be solved if the Identity Provider implements Platform SSO , but not being implemented by all major Identity Providers Except major iDPs like Okta, Microsoft, Ping


Since Platform SSO Offers the necessary framework and provision that satisfy the above needs I planned to make a open-source initiative to bridge in PSSO and Oauth ROPG to connect with Any OpenID Provider that supports Oauth ROPG


I KNOW PSSO DOESN’T MEANT FOR THIS AND NEEDS TO BE IMPLEMENTED BY IDP, AND MEANINGFUL SSO TOKENS CAN BE ONLY ISSUED BY THEM TO HELP THE SSO EXTENSION


But the native login Experience, FileVault Synchronization, Keychain Unlock everything being handled by OS in PSSO. I thought its best to go in this way

The Attachment Includes the Components, Design Decisions of this Project , Questions in the PSSO Framework workflow. Including some Questions from new WWDC26 OpenID Authentication Method introduced in PlatformSSO

Please help with the Questions in the Attachment and post if there is any suggestions on the workflow I described

Filed Feedback with FB23065453

linked wrong attachment . The attachments can be found at https://developer.apple.com/forums/thread/832604 we can have the discussion there

Questions on Platform SSO - Password grant Type Flow Implementations
 
 
Q