Determining whether an Application is Implemented as an SSO Application

Check with your mobile device management (MDM) provider to see if the application has an SSO application. In that case, you could have an SSO application from your MDM application which provisions a certificate from a shared certificate, and SAP Fiori Client or the Hybrid SDK (Kapsel) could retrieve the certificate. In this situation, you do not need to create a custom provider. If you lack an SSO application, you could create a custom provider as described in these sections.

Using the CertificateProvider Interface with Kapsel Applications

For Kapsel SDK applications, you can implement and integrate a customized CertificateProvider into a Hybrid SDK (Kapsel) application to get the signed certificate (X509KeyManager for Android, or SecIdentityRef for iOS) for mutual authentication or application registration. When the application starts, you should set the logonContext and appDelegate objects and use them as parameters in the call to the sap.logon.startLogonInit method. The sap.logon.startLogonInit method first sends a request to the certificate provider to retrieve a client certificate if the certificate is not yet retrieved previously. Once the certificate is available on the device, the method calls logon.init to start the registration.

Note that the Logon plugin has built-in support for the Afaria certificate provider. Two certificate provider IDs can be used for the Afaria certificate: "com.sap.afaria" is for the new Afaria certificate provider, and "afaria" is used for the old logon core Afaria certificate support (which is not implemented as a certificate provider).

For the iOS client, in order to use the "com.sap.afaria" or "afaria" as a certificate provider in the Kapsel project, besides setting the certificate provider ID in the startLogonInit's logonContext parameter, you also need to create a unique URL identifier and URL Scheme in the project settings in order to receive the openURL requests from the Afaria client. However, there is no need to update the plist file to specify the certificate provider ID to class mapping as required for third party certificate providers, or to add any extra libraries into the project.