PIN Security for a Force.com Mobile SDK App

Question

There's a feature for PIN protection which works with Mobile SDK applications which provides an extra level of security for users. The PIN configuration is done as part of a connected app as shown below

Therefore, the PIN is tied to each org (where the connected app is created). Normally, a mobile iOS app which is distributed via App Store can't really be tied to a specific org so it would use a dummy client secret in the bootconfig.json file. The client secret is based on a Connected App.

Normally, it would not matter to use a dummy client secret but to use the PIN auth feature, the client secret must be of the org where the connected app has been created and PIN feature enabled. Therefore, my question is there a way to generalise this for apps which are to be distributed via public app store? How can I enable pin protection for an app to work on any org because the client secret is actually for a specific org and tied to my app code? The only approach I see as of now is to release separate IPA files for each org which is not a practical solution for App Store distribution anyway.

I'm looking for a confirmation on whether it's actually possible to use pin protection in an org independent manner? Like perhaps packing the Connected app in a managed/ unmanaged package and forcing all users to install it in the orgs where they intend to use the mobile app?

Answer 1

It took me a while but I figured it out. The PINs configuration on each org's connected app will be different so the solution was to package up the Connected app as part of a managed package which can be deployed on any org. The app still uses the same client secret in the bootconfig.json file so it works across all orgs as long as the managed package has been deployed - the key is that you do not need to change the client secret in the app code (which would then warrant frequent re-submissions on App Store).