Simple Authentication for Setup Assistant

When users enroll to Platform SSO when setting up a new Mac, usually there's a device registration where the user authenticates with the IDP password:

That authentication gives the macOS SSO extension some tokens. This is interesting for one reason:

When it comes to the user registration, the user needs to authenticate with the IdP with its native interface. For example:

The main purpose here is to use 2FA. So it is a bit of a hassle that the user must type the username and password again.

To avoid this, we developed another authenticator just for the purpose of Setup Assistant:

This will take a refresh token which was received by the SSO extension and sends it to Keycloak as a header. If valid, Keycloak will skip username and password and either return back with a fully authenticated user, or will display 2FA if you configured the flow for that.

In order to use this authenticator during Setup Assistant, configure a flow for the PSSO client, for example, like this:

We recommend that you use a dedicated flow for the PSSO client so that only in that situation it will use this authenticator.