Certificate-based authentication for Single Sign-On on mobile devices

Certificate-Based Authentication (CBA) is a secure authentication method for mobile devices, enhancing the security of Single-Sign On (SSO) solutions by using digital certificates. This article details how to integrate CBA with your SSO setup, ensuring a secure and streamlined sign-in process for users of Axon mobile applications.

Prerequisites

  • A Mobile Device Manager (MDM). iOS requires any certificates used as part of the SSO flow are managed by an MDM.An MDM helps integrate and ensure secure delivery of certificates from the identity provider to the device.
  • Axon apps that support CBA.
  • SSO configured with Identity Provider. To use CBA, you must user a third-party identity provider.

Integrate your identity provider with an MDM

Active Directory Federation Services (AD FS), Microsoft Entra ID, and Okta all have methods of providing certificates using Active Directory Certificate Services. Refer to the following resources for more information on integrating these with an MDM, such as Airwatch.

Troubleshooting

Enabling support for certificates generally involves two pieces of customer software (MDM and Identity Providers) that are not provided by Axon. The following are tips for working with CBA.

  • Ensure the Port Configuration for the IDP is correct. Certificate Based Authentication often uses a different subdomain or port than Username/Password logins. Check with your identity provider and ensure your organization has those domains allowed or ports made available to the devices.
  • Ensure the Certificate Request from the MDM is correct. The most common configuration for automatic certificate generation for mobile devices has the MDM requesting a certificate from the Certificate Authority, providing the Subject Name and Subject Alternate Name in the request. The IDP might have specific requirements for the SN/SAN that need to be in the request (for example, ADFS requires the SAN to contain User Principal Name).
  • Ensure the Certificate Authority is trusted by iOS/Android or Included in the MDM Profile. Issues can arise with mobile devices and with SSO in general when the Certificate Authority used by the IDP is not trusted by devices. Ensure that the Certificate Authority is one of the default trusted CAs or is included in the MDM Profile provided to the device.

Additional Resources

For further guidance and detailed information on configuring SSO with Axon, refer to the following resources: