Support app groups on iOS

On iOS, app groups enable multiple apps from the same development team to share data and communicate with each other. This is achieved by providing a shared container on the device where these apps store and access data.

The SDK supports app groups to enable the following scenarios:

• Hybrid authentication (cross-device authentication)

• Access to credentials from app extensions (like the Credential Provider extension)

• Sharing credentials across multiple apps from the same developer

Set up app groups

1. Configure app groups entitlements

Before using the SDK's app groups feature, you MUST first configure your app's entitlements:

1. In Xcode, select your project in the Project Navigator.

2. Select your target and go to the Signing & Capabilities tab.

3. To add the App Groups capability, click the plus + button.

4. Add an app groups identifier (such as group.com.example.appgroup).

2. Configure the SDK to use app groups

Use the setAppGroup API to configure the SDK to use your app groups:

TGFFido2Config.setAppGroup("group.com.example.appgroup")

Call this API before the Mobile FIDO SDK is initialized:

TGFFido2Config.setAppGroup("group.com.example.appgroup")
let client = try? TGFFido2ClientFactory.client()

Migrate existing data to app groups

This section focuses on apps that already contain existing credentials prior to enabling app groups.

When implementing app groups support in an existing app that already uses the Mobile FIDO SDK, you need to migrate existing credential data to the shared container.

1. Check if migration is required

First, check if data migration is required using the shouldPerformDataMigration API:

TGFFido2Config.shouldPerformDataMigration()

This function returns true if a data migration is required, which means there is existing data and a change in the keychain access group or app groups is required.

2. Perform the data migration

If migration is required, use the performDataMigration: API to migrate the data:

  do { 
    try TGFFido2Config.performDataMigration()
  } catch let error {
    print("Migration failed: \(error.localizedDescription)")
  }

This function migrates the necessary SDK data to the app groups container. It completes normally when the migration succeeds (or when no migration is required), and throws an error if the migration fails — handle it with try/catch as shown above.

Migration workflow example

Here's an example of how to implement the migration workflow in your app:

// 1. Configure the app groups
TGFFido2Config.setAppGroup("group.com.example.appgroup")

// 2. Check if migration is needed
if TGFFido2Config.shouldPerformDataMigration() {
    // 3. Perform migration if needed
    do {
      try TGFFido2Config.performDataMigration()
    } catch let error {
      print("Migration failed: \(error.localizedDescription)")
    }
}