<!--
{
  "availability" : [
    "macOS: 13.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "AuthenticationServices",
  "identifier" : "/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration",
  "metadataVersion" : "0.1.0",
  "role" : "Class",
  "symbol" : {
    "kind" : "Class",
    "modules" : [
      "Authentication Services"
    ],
    "preciseIdentifier" : "c:objc(cs)ASAuthorizationProviderExtensionLoginConfiguration"
  },
  "title" : "ASAuthorizationProviderExtensionLoginConfiguration"
}
-->

# ASAuthorizationProviderExtensionLoginConfiguration

An interface for configuring platform single sign-on.

```
class ASAuthorizationProviderExtensionLoginConfiguration
```

## Overview

This class provides login configuration information for platform single sign-on.

## Topics

### Creating the configuration

[`init(clientID:issuer:tokenEndpointURL:jwksEndpointURL:audience:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/init(clientID:issuer:tokenEndpointURL:jwksEndpointURL:audience:))

Creates a configuration with the required values.

[`configuration(openIDConfigurationURL:clientID:issuer:completion:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/configuration(openIDConfigurationURL:clientID:issuer:completion:))

Creates a login configuration using the OpenID configuration.

### Obtaining the required configuration

[`audience`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/audience)

The audience for validation and requests.

[`clientID`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/clientID)

The identifier for the client at the identity provider.

[`jwksEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/jwksEndpointURL)

The JSON Web Key Set endpoint URL for keys.

[`tokenEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/tokenEndpointURL)

The token endpoint URL for login requests.

[`issuer`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/issuer)

The issuer of the identity token that the identity provider returns.

### Obtaining the recommended configuration

[`accountDisplayName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/accountDisplayName)

The display name for the account.

[`invalidCredentialPredicate`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/invalidCredentialPredicate)

The predicate string that identifies invalid credential errors.

### Configuring the server nonce

[`customNonceRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customNonceRequestValues)

Custom values to add to the server nonce POST request body.

[`nonceEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/nonceEndpointURL)

The URL to retrieve a one-time use value from the server.

[`nonceResponseKeypath`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/nonceResponseKeypath)

The keypath in the response that contains the one-time use value.

[`serverNonceClaimName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/serverNonceClaimName)

The name of the claim to include in authentication requests.

### Configuring the previous refresh token

[`includePreviousRefreshTokenInLoginRequest`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/includePreviousRefreshTokenInLoginRequest)

A Boolean value that indicates whether to include the previous refresh token in the authentation request.

[`previousRefreshTokenClaimName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/previousRefreshTokenClaimName)

The claim name for the previous single sign-on token value in the authentication request.

### Customizing the authentication request

[`setCustomAssertionRequestBodyClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomAssertionRequestBodyClaims(_:))

Adds the custom claims to the embedded assertion request body.

[`setCustomAssertionRequestHeaderClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomAssertionRequestHeaderClaims(_:))

Adds the custom claims to the embedded assertion request header.

[`setCustomLoginRequestBodyClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomLoginRequestBodyClaims(_:))

Adds the custom claims to the login request body.

[`setCustomLoginRequestHeaderClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomLoginRequestHeaderClaims(_:))

Adds the custom claims to the login request header.

[`additionalScopes`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/additionalScopes)

A set of extra scopes to add to the base for the authentication request.

[`customLoginRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customLoginRequestValues)

Provider-supplied values to add to the login POST request body.

[`kerberosTicketMappings`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/kerberosTicketMappings)

The set of ticket mappings the system uses to import Kerberos tickets from the single sign-on token.

### Instance Properties

[`additionalAuthorizationScopes`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/additionalAuthorizationScopes)

[`customFederationUserPreauthenticationRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customFederationUserPreauthenticationRequestValues)

[`customKeyExchangeRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customKeyExchangeRequestValues)

[`customKeyRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customKeyRequestValues)

[`customRefreshRequestValues`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customRefreshRequestValues)

[`customRequestJWTParameterName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/customRequestJWTParameterName)

[`deviceContext`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/deviceContext)

[`federationMEXURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationMEXURL)

[`federationMEXURLKeypath`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationMEXURLKeypath)

[`federationPredicate`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationPredicate)

[`federationRequestURN`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationRequestURN)

[`federationType`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationType-swift.property)

[`federationUserPreauthenticationURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/federationUserPreauthenticationURL)

[`groupRequestClaimName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/groupRequestClaimName)

[`groupResponseClaimName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/groupResponseClaimName)

[`jwksTrustedRootCertificates`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/jwksTrustedRootCertificates-5y2pc)

[`keyEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/keyEndpointURL)

[`loginRequestEncryptionAPVPrefix`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/loginRequestEncryptionAPVPrefix)

[`loginRequestEncryptionPublicKey`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/loginRequestEncryptionPublicKey)

[`refreshEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/refreshEndpointURL)

[`uniqueIdentifierClaimName`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/uniqueIdentifierClaimName)

[`userSecureEnclaveKeyBiometricPolicy`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/userSecureEnclaveKeyBiometricPolicy-swift.property)

[`jwksTrustedRootCertificates`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/jwksTrustedRootCertificates-605jm)

### Instance Methods

[`setCustomKeyExchangeRequestBodyClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomKeyExchangeRequestBodyClaims(_:))

[`setCustomKeyExchangeRequestHeaderClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomKeyExchangeRequestHeaderClaims(_:))

[`setCustomKeyRequestBodyClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomKeyRequestBodyClaims(_:))

[`setCustomKeyRequestHeaderClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomKeyRequestHeaderClaims(_:))

[`setCustomRefreshRequestBodyClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomRefreshRequestBodyClaims(_:))

[`setCustomRefreshRequestHeaderClaims(_:)`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/setCustomRefreshRequestHeaderClaims(_:))

### Structures

[`ASAuthorizationProviderExtensionLoginConfiguration.UserSecureEnclaveKeyBiometricPolicy`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/UserSecureEnclaveKeyBiometricPolicy-swift.struct)

### Enumerations

[`ASAuthorizationProviderExtensionLoginConfiguration.FederationType`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/FederationType-swift.enum)


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)