Hi Apple Community, I have been Developing Platform SSO With OpenID as Authentication Method, This is Great as it will allow clients to Configure their own Identity Provider Authentication Policy Enforced at Login Screen I have used Platform SSO with dynamicOpenID method with this , macOS sends redirect_uri=com.apple.PlatformSSO://callback (Camel Case "com.apple.PlatformSSO") to the Identity Provider during OIDC Authentication to Authorization URL . After During Platform SSO Login Request The subject_token in the Login Request then contains com.apple.platformsso://callback (lowercase). RFC 6749 Section 4.1.3 requires these values to be identical, so my Identity Provider rejects the token request. Is this expected, or a macOS bug? Environment macOS version: Golden Gate ( 27.0.1 ) Platform SSO Authentication method: OpenID ( dynamicOpenID ) Document Followed : https://developer.apple.com/documentation/authenticationservices/implementing-web-based-authentication Configuration federationType = .dynamicOpenID fallbackFederationType = .dynamicOpenID authorizationURLKeypath = "authorizationURL" Reference Steps to reproduce macOS makes the pre-authentication request, and my server responds: HTTP/1.1 200 OK Content-Type: application/json { "account_type": "Federated", "federation_protocol": "OIDC", "authorizationURL": "https://idp.example.com/authorize?state=random" }Platform SSO opens a WebView, loads the authorization URL, and appends redirect_uri with a capital "PSSO": GET https://idp.example.com/authorize?state=random&redirect_uri=com.apple.PlatformSSO://callbackAuthentication completes. Platform SSO then sends the Login Request. The decoded JWT claims contain a subject_token with a lowercase "platformsso": { "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", "subject_token": "com.apple.platformsso://callback?code=gAJZwNpLDPardp8NKwvyyJLYefxLqMQH&state=ABCD1234", "subject_token_type": "urn:apple:platformsso:authorization-code-response", "scope": "openid offline_access urn:apple:platformsso urn:apple:platformsso:auth:auth-prompt", "aud": "https://auth.example.com/auth/token", "...": "other claims omitted for brevity" }The mismatch Authorization request (WebView): com.apple.PlatformSSO://callback Login Request subject_token: com.apple.platformsso://callback Why it matters RFC 6749 Section 4.1.3 says redirect_uri is REQUIRED in the token request if it was included in the authorization request, and the values MUST be identical. Because the two differ, a spec-compliant IdP rejects the code exchange. Expected behavior Both stages use the same redirect_uri string. Actual behavior The scheme differs in case, and the IdP rejects the request. Questions Is this intentional? If so, how should an IdP handle it without breaking RFC compliance? Is there a configuration option to control or normalize the redirect_uri that Platform SSO sends? Can someone from the Community help with how to overcome this if faced Thanks!!!

Hi Apple Community, Problem : Should be able to use my iDP password when I try to unlock my macOS local User Account.
 Password should sync across my macOS local User Account, when my User Account Password in iDP Changed
 Should have a provision to create a on-demand macOS local account with password of iDP Should be able to Create Primary Account in Automated Device Enrollment with password synced to iDP ( Simplified PSSO in Setup Assistant ) Solution : These can be solved if the Identity Provider implements Platform SSO , but not being implemented by all major Identity Providers Except major iDPs like Okta, Microsoft, Ping 
Since Platform SSO Offers the necessary framework and provision that satisfy the above needs I planned to make a open-source initiative to bridge in PSSO and Oauth ROPG to connect with Any OpenID Provider that supports Oauth ROPG 
I KNOW PSSO DOESN’T MEANT FOR THIS AND NEEDS TO BE IMPLEMENTED BY IDP, AND MEANINGFUL SSO TOKENS CAN BE ONLY ISSUED BY THEM TO HELP THE SSO EXTENSION 
But the native login Experience, FileVault Synchronization, Keychain Unlock everything being handled by OS in PSSO. I thought its best to go in this way The Attachment Includes the Components, Design Decisions of this Project , Questions in the PSSO Framework workflow. Including some Questions from new WWDC26 OpenID Authentication Method introduced in PlatformSSO Please help with the Questions in the Attachment and post if there is any suggestions on the workflow I described Filed Feedback with FB23065453

Hi Apple Community & Apple Team, 
Problem : Should be able to use my iDP password when I try to unlock my macOS local User Account.
 Password should sync across my macOS local User Account, when my User Account Password in iDP Changed
 Should have a provision to create a on-demand macOS local account with password of iDP Should be able to Create Primary Account in Automated Device Enrollment with password synced to iDP ( Simplified PSSO in Setup Assistant ) Solution : All the above Problems can be solved if the Identity Provider implements Platform SSO , but not being implemented by major Identity Providers Except Okta, Microsoft, Ping 
Since Platform SSO Offers the necessary framework and provision that satisfy the above needs I planned to make a open-source initiative to bridge in PSSO and Oauth ROPG to connect with Any OpenID Provider that supports Oauth ROPG ( Resource Owner Password Grant ) 
ITS RIGHT THAT PSSO DOESN’T MEANT FOR THIS AND NEEDS TO BE IMPLEMENTED BY IDENTITY PROVIDER, AND MEANINGFUL ID TOKENS CAN BE ONLY USED BY THEM TO HELP THE SSO EXTENSION 
But the native login Experience, FileVault Synchronization, Keychain Unlock everything being handled by OS in PSSO. I thought its best to go in this way The Attachment Includes the Components, Design Decisions of this Project , Questions in the PSSO Framework workflow. Including some Questions from new WWDC26 OpenID Authentication Method introduced in PlatformSSO Please help with the Questions in the Attachment and post if there is any suggestions on the workflow I described Filed a Feedback with ID FB23065453