Ping SDKs

Step 2. Configure connection properties

In this step, you configure the "swiftui-oidc" app to connect to the OAuth 2.0 application you created in PingFederate, and display the login UI of the server.

  1. In Xcode, on the File menu, click Open.

  2. Navigate to the sdk-sample-apps folder you cloned in the previous step, navigate to iOS > swiftui-oidc > PingExample > PingExample.xcodeproj, and then click Open.

  3. In the Project Navigator pane, navigate to PingExample > PingExample > Utilities, and open the ConfigurationManager file.

  4. Locate the ConfigurationViewModel function which contains placeholder configuration properties.

    The function is commented with //TODO: in the source to make it easier to locate. 
    return ConfigurationViewModel(
    clientId: "[CLIENT ID]",
    scopes: ["openid", "email", "address", "phone", "profile"],
    redirectUri: "[REDIRECT URI]",
    signOutUri: "[SIGN OUT URI]",
    discoveryEndpoint: "[DISCOVERY ENDPOINT URL]",
    environment: "[ENVIRONMENT - EITHER AIC OR PingOne]",
    cookieName: "[COOKIE NAME - OPTIONAL (Applicable for AIC only)]",
    browserSeletorType: .authSession
)

  5. In the ConfigurationViewModel function, update the following properties with the values you obtained when preparing your environment.

    clientId

    The client ID from your OAuth 2.0 application in PingFederate.

    For example, sdkPublicClient

    scopes

    The scopes you want to assign in PingFederate.

    For example, openid profile email phone

    redirectUri

    The Redirect URIs as configured in the OAuth 2.0 client profile.

    This value must exactly match a value configured in your OAuth 2.0 client.

    For example, org.forgerock.demo://oauth2redirect

    signOutUri

    The Front-Channel Logout URIs as configured in the OAuth 2.0 client profile.

    This value must exactly match a value configured in your OAuth 2.0 client.

    For example, org.forgerock.demo://oauth2redirect

    discoveryEndpoint

    The .well-known endpoint from your PingFederate tenant.

    How do I form my PingFederate .well-known URL?

    To form the .well-known endpoint for a PingFederate server:

    1. Log in to your PingFederate administration console.

    2. Navigate to System  Server  Protocol Settings.

    3. Make a note of the Base URL value.

      For example, https://pingfed.example.com

      Do not use the admin console URL.

    4. Append /.well-known/openid-configuration after the base URL value to form the .well-known endpoint of your server.

      For example, https://pingfed.example.com/.well-known/openid-configuration.

      The SDK reads the OAuth 2.0 paths it requires from this endpoint.

    For example, https://pingfed.example.com/.well-known/openid-configuration

    environment

    Ensures the sample app uses the correct behavior for the different servers it supports, for example what logout parameters to use.

    For PingFederate specify PingOne.

    cookieName

    Set this property to an empty string.

    For example, "".

    *browserSeletorType*

    You can specify what type of browser the client iOS device opens to handle centralized login.

    Each browser has slightly different characteristics, which make them suitable to different scenarios, as outlined in this table:

    Browser type Characteristics

    .authSession

    Opens a web authentication session browser.

    Designed specifically for authentication sessions, however it prompts the user before opening the browser with a modal that asks them to confirm the domain is allowed to authenticate them.

    This is the default option in the Ping SDK for iOS.

    .ephemeralAuthSession

    Opens a web authentication session browser, but enables the prefersEphemeralWebBrowserSession parameter.

    This browser type does not prompt the user before opening the browser with a modal.

    The difference between this and .authSession is that the browser does not include any existing data such as cookies in the request, and also discards any data obtained during the browser session, including any session tokens.

    When is ephemeralAuthSession suitable:

    • ephemeralAuthSession is not suitable when you require single sign-on (SSO) between your iOS apps, as the browser will not maintain session tokens.

    • ephemeralAuthSession is not suitable when you require a session token to log a user out of the server, for example for logging out of PingOne, as the browser will not maintain session tokens.

    • Use ephemeralAuthSession when you do not want the user’s existing sessions to affect the authentication.

    .nativeBrowserApp

    Opens the installed browser that is marked as the default by the user. Often Safari.

    The browser opens without any interaction from the user. However, the browser does display a modal when returning to your application.

    .sfViewController

    Opens a Safari view controller browser.

    Your client app is not able to interact with the pages in the sfViewController or access the data or browsing history.

    The view controller opens within your app without any interaction from the user. As the user does not leave your app, the view controller does not need to display a warning modal when authentication is complete and control returns to your application.

    The result resembles the following:

    return ConfigurationViewModel(
    clientId: "sdkPublicClient",
    scopes: ["openid", "email", "phone", "profile"],
    redirectUri: "org.forgerock.demo://oauth2redirect",
    signOutUri: "org.forgerock.demo://oauth2redirect",
    discoveryEndpoint: "https://pingfed.example.com/.well-known/openid-configuration",
    environment: "PingOne",
    cookieName: "",
    browserSeletorType: .authSession
)

With the sample configured, you can proceed to Step 3. Test the app.