Configuring the DaVinci module

PingOne iOS

Configure DaVinci module for iOS properties to connect to PingOne and step through an associated DaVinci flow.

There are two methods for configuring the DaVinci module:

Full configuration: Use the Swift builder closure to access all available settings, including iOS-specific options such as keychain access groups, custom HTTP clients, and storage configuration.
Common JSON configuration: Use a shared key-value structure that works identically across Android, iOS, and JavaScript, letting you load a single config file across platforms.

Full configuration

The following shows an example DaVinci module configuration, using the underlying Oidc module:

Configure DaVinci module connection properties

let davinciClient = DaVinci.createDaVinci { config in
    config.logger = LogManager.standard
    // Oidc as module
    config.module(OidcModule.config) { oidcValue in
        oidcValue.clientId = "6c7eb89a-66e9-ab12-cd34-eeaf795650b2"
        oidcValue.discoveryEndpoint = "https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/as/.well-known/openid-configuration"
        oidcValue.scopes = ["openid", "profile", "email", "address", "revoke"]
        oidcValue.redirectUri = "com.example.demo://oauth2redirect"
        oidcValue.par = true
        oidcValue.additionalParameters = ["customKey":"customValue"]
    }
}

Common JSON configuration

You can provide the same configuration as a JSON-compatible dictionary, which lets you share a single config file across Android, iOS, and JavaScript.

Configure the DaVinci module from a JSON dictionary

let json: [String: Any] = [
    "timeout": 30000, // milliseconds
    "log": "WARN",
    "oidc": [
        "clientId": "6c7eb89a-66e9-ab12-cd34-eeaf795650b2",
        "discoveryEndpoint":
            "https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/as/.well-known/openid-configuration",
        "scopes": ["openid", "profile", "email", "revoke"],
        "redirectUri": "com.example.demo://oauth2redirect"
    ]
]

switch DaVinci.createDaVinci(json: json) {
case .success(let davinciClient):
    // use davinciClient
case .failure(let error):
    // handle configuration error
}

Optionally, you can store this JSON in a file alongside your app and load it at runtime so the same file can be shared across platforms.

The JSON factory and the native DaVinci.createDaVinci { } builder closure are mutually exclusive, there is no combined form.

If you need iOS-specific settings such as keychain access groups, httpClient, or storage configuration, use the native builder closure for the entire configuration instead.

Configuration property reference

The following properties are available when configuring the DaVinci module for iOS.

The JSON property column shows the equivalent key when using JSON configuration.

Property JSON property Description Required?

logger

log

Specify which logger the Orchestration SDK should use to output messages. Select from the built-in presets standard (the default), warning, or none.

You can also create and use your own logger implementation. Learn more in Customizing logging on iOS.

In JSON configuration, use the log property at the root level.

timeout

A timeout, in seconds, for each request that communicates with the server.

Default is 30 seconds.

When using JSON configuration, specify timeout at the root level with the value in milliseconds:

{
  "timeout": 30000
}

acrValues

oidc.acrValues

Request which flow the PingOne server uses by adding an Authentication Context Class Reference (ACR) parameter.

Enter a single DaVinci policy by using its flow policy ID.

Example:

"d1210a6b0b2665dbaa5b652221badba2"

additionalParameters

oidc.additionalParameters

Add additional key-pair parameters as query strings to the initial OAuth 2.0 call to the /authorize endpoint.

For example, myConfig.additionalParameters = ["customKey":"customValue"]

You can access these additional OAuth 2.0 parameters in your DaVinci flows by using the authorizationRequest.<customParameter> property.

Learn more in Referencing PingOne data in the flow.

clientId

oidc.clientId

The client_id of the OAuth 2.0 client profile to use.

For example, 6c7eb89a-66e9-ab12-cd34-eeaf795650b2

Yes

discoveryEndpoint

oidc.discoveryEndpoint

Your PingOne server’s .well-known/openid-configuration endpoint.

Example:

https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/as/.well-known/openid-configuration

Yes

par

oidc.par

Whether to use Pushed Authorization Requests (PAR) for communicating with the authorization server.

Learn more in Securing OIDC sign-on with Pushed Authorization Requests.

redirectUri

oidc.redirectUri

The redirect_uri as configured in the OAuth 2.0 client profile.

This value must match a value configured in your OAuth 2.0 client.

For example, com.example.demo://oauth2redirect.

Yes

scopes

oidc.scopes

A set of scopes to request when performing an OAuth 2.0 authorization flow.

For example, "openid", "profile", "email", "address", "revoke".

Yes

display

oidc.display

How the authorization server should display the authentication UI.

page: Full-page redirect (default).
popup: Pop-up window.
touch: Optimized for touch-based devices.
wap: Optimized for WAP/mobile browsers.

loginHint

oidc.loginHint

A hint to pre-populate the username field on the authorization server’s sign-on page.

For example, user@example.com

nonce

oidc.nonce

A value to associate with the ID token to prevent replay attacks.

If not set, the SDK generates a nonce automatically.

prompt

oidc.prompt

Controls whether the authorization server prompts the user for re-authentication or consent.

Select one of the following:

none: No UI; returns an error if interaction is required.
login: Force re-authentication.
consent: Request consent even if previously granted.
select_account: Prompt to select an account.

refreshThreshold

oidc.refreshThreshold

The number of seconds before token expiry at which the SDK proactively refreshes the token.

Defaults to 0, meaning the SDK refreshes only when the token has expired.

signOutRedirectUri

oidc.signOutRedirectUri

The URI to redirect to after sign-out.

Maps to the post_logout_redirect_uri parameter in the end-session request.

This value must be registered in your OAuth 2.0 client.

uiLocales

oidc.uiLocales

Space-separated BCP 47 language tags indicating the preferred display language for the authorization server’s UI.

For example, en-US fr

Orchestration SDKs

Configuring the DaVinci module

Full configuration

Common JSON configuration

Configuration property reference