We are working on a pilot project wherein a SAML IDP is set-up to authenticate using client certificates (sorted in the iOS system key-chain). How can the salesforce1 mobile app be configured to work with the IDP to ensure a seamless logon experience for the end-user? From what I am seeing that this is only possible if the salesforce1 app uses SFSafariViewController (https://developer.pingidentity.com/en/resources/napps-native-app-sso.html#index). Does anyone have any experience with similar (or an alternative) approach that works ?
As far as I'm aware Salesforce1 can only use the cert based auth flow if you are using a Mobile Device Management solution. Check out chapter 7 in the Salesforce1 Security Guide https://resources.docs.salesforce.com/208/latest/en-us/sfdc/pdf/salesforce1_mobile_security.pdf