🎓beginner⏱30 min.Mobile Development Kit ClientBeginnerIosAndroidMobileSAP Business Technology PlatformSAP Mobile ServicesSAP Build CodeSAP BuildSAP Business Application Studio
You will learn
✔How to define your Mobile Services app to support certificate authentication
Download the latest version of mobile development kit SDK either from the SAP community trial download or SAP Software Center if you are a SAP Mobile Services customer
On the home screen, click Create New App or navigate to Mobile Applications→Native/MDK→New.
MDK
In the Type of Application step, select the mobile development kit (MDK) and choose Next.
MDK
In the Basic Info step, provide the required information and choose Next.
Field
Value
ID
myapp.mdk.certs
Name
SAP MDK cert auth App
MDK
Other fields are optional. For more information about these fields, see Creating Applications in the SAP documentation.
In the Security Settings step, continue with the default settings and choose Next.
MDK
In the Role Settings step, continue with the default settings and choose Next.
MDK
In the Assign Features step, continue with the default settings and choose Next.
MDK
In the Review step, you can verify the details of the application definition that you are creating. Make sure all the details are correct. Choose Edit to make any necessary modifications to the section. Choose Finish to create the mobile application configuration.
MDK
If you see a Application is without Role Settings warning message, choose OK. You may assign roles after the app has been configured, if needed.
Once you have created your application, you see a list of default features have been automatically assigned to the app.
MDK
You can find more information on available features in SAP Mobile Services in help documentation.
Step 2Modify the default OAuth security settings
+
When you configure an MDK app in Mobile Service admin UI, OAuth security is assigned to the app by default.
To enable certificate based authentication, you need to modify Redirect URL in Security configuration.
Click the Security tile.
MDK
Click pencil icon to make changes to default configuration.
MDK
Replace the Redirect URL with mdkcertclient://oauth2redirect parameter, and click OK to save the changes. This Redirect URL needs to be added in the AllowedDomains property while building your branded client (step 3.5).
MDK
mdkcertclient is an URL scheme for your branded MDK client, you will use this value in step 3.3.
oauth2redirect is just a random path. It could be any value.
To build your client,
you can either use Cloud Build service option to build a standard MDK client by selecting Allow Certificate option or upload the mdkproject to build a customized MDK client.
OR build your branded client locally using MDK SDK as mentioned in below steps.
Step 3Create your .mdkproject folder
+
Make sure you are choosing the right development platform tab above.
In the MDKClient_SDK folder, you will find the template.mdkproject folder.
MDK
It is recommended that you copy this folder to another location so that you can to use it for future builds. Copy and paste it anywhere, and then rename the template to MDKCertApp.mdkproject.
MDK
Next, you will need to update the BrandedSettings.json and MDKProject.json files as needed for your client. Go into the MDKCertApp.mdkproject folder.
MDK
Open the MDKProject.json file and update it as needed. This file has some build-time configurations such as the application name, version and bundle ID.
MDK
AppDisplayName: This is the name of the application on the home screen of the device.
AppName: This is the name of the folder where the client is created.
BundleID: It should be a unique identifier for your application. This controls if the client can be installed side by side with other applications on the device. Two applications with the same Bundle ID cannot be installed at the same time on a device. For iOS this is the Identifier (AppID) that is registered in Apple Developer account since that determines if the application can be installed alongside other applications. If the XCode project is set up to use Automatically manage signing then when building, XCode will automatically generate a signing profile for the specified bundle id. Without matching them, trying to run the custom client in iOS device will result in failure. In Android, it is known as application ID.
UrlScheme: Allows you to specify a custom URL scheme which opens the client. This value is provided in step 2 for Redirect URL.
If the URL includes connection settings as URL parameters, these settings will override the ones used by the client. This value mdkcertclient needs to match the value provided in step 2 for the Redirect URL. This value also needs to be unique across applications on your device. If the value is not unique the wrong application may be referenced when redirecting.
Open the BrandedSettings.json file and update the ConnectionSettings with the values for your MDK application in Mobile Services. To update the AppId, ClientId, ServerUrl, AuthorizationEndPointUrl, RedirectUrl and TokenUrl in the ConnectionSettings block, navigate to the Mobile Services admin UI, click myapp.mdk.certs > Settings > Client Settings > Info tab, copy the highlighted block and paste it in BrandedSettings.json.
MDK
MDK
You also need to update the AllowCerts property to true into the ConnectionSettings block.
MDK
AllowCerts property allows MDK client to access the certificate on the device during on-boarding if requested by the Identity provider (IdP). You can find more information about this property in help documentation.
To find the correct URLs for your client, you should navigate to Mobile Services admin UI and find your MDK application that you want to link to this client.
Regarding other properties:
Debug settings: The settings in the DebugSettings property are for development use and should not be enabled in a production setting.
Log Settings: Set this to the log level to be used when the client is launched.
Demo: If you want to access the app in the demo mode, you can configure required settings.
If you are connecting to AliCloud accounts, you will also need to add your custom domains under URLWhitelist property in the same file. You can find more details in documentation.
Add mdkcertclient://oauth2redirect in the AllowedDomains property.
MDK
If you are connecting to AliCloud accounts, you will also need to add your custom domains under the same AllowedDomains property. You can find more details in documentation.
In the last section of BrandedSettings.json file, make these changes:
Field
Value
DetailLabelViewText
Branded client that can on-board using certificates for authentication
SigninButtonText
Start
MDK
In the MDKClient_SDK folder, you will find the template.mdkproject folder.
MDK
It is recommended that you copy this folder to another location so that you can to use it for future builds. Copy and paste it anywhere, and then rename template to MDKCertApp.mdkproject.
MDK
Next, you will need to update the MDKProject.json and BrandedSettings.json files as needed for your client. Go into the MDKCertApp.mdkproject folder.
MDK
Open the MDKProject.json file and update it as needed. This file has some build-time configurations such as the application name, version and bundle ID.
MDK
AppDisplayName: This is the name of the application on the home screen of the device.
AppName: This is the name of the folder where the client is created.
BundleID: It should be a unique identifier for your application. This controls if the client can be installed side by side with other applications on the device. Two applications with the same Bundle ID cannot be installed at the same time on a device. In Android, it is known as application ID.
UrlScheme: Allows you to specify a custom URL scheme which opens the client. This value is provided in step 2 for Redirect URL.
If the URL includes connection settings as URL parameters, these settings will override the ones used by the client. This value mdkcertclient needs to match the value provided in step 2 for the Redirect URL. This value also needs to be unique across applications on your device. If the value is not unique the wrong application may be referenced when redirecting.
Open the BrandedSettings.json file and update the ConnectionSettings with the values for your MDK application in Mobile Services. To update the AppId, ClientId, ServerUrl, AuthorizationEndPointUrl, RedirectUrl and TokenUrl in the ConnectionSettings block, navigate to the Mobile Services admin UI, click myapp.mdk.certs > Mobile Security Exchange > Info tab, copy the highlighted block and paste it in BrandedSettings.json.
MDK
MDK
You also need to update the AllowCerts property to true into the ConnectionSettings block.
MDK
AllowCerts property allows MDK client to use the certificate. You can find more information about this property in help documentation. To access the certificate on the device during on-boarding if requested by the Identity provider (IdP).
To find the correct URLs for your client, you should navigate to Mobile Services admin UI and find your MDK application that you want to link to this client.
Regarding other properties:
Debug settings: The settings in the DebugSettings property are for development use and should not be enabled in a production setting.
Log Settings: Set this to the log level to be used when the client is launched.
Demo: If you want to access the app in the demo mode, you can configure required settings.
Add mdkcertclient://oauth2redirect in the AllowedDomains property.
MDK
If you are connecting to AliCloud accounts, you will also need to add your custom domains under the same AllowedDomains property. You can find more details in documentation.
In the last section of BrandedSettings.json file, make these changes:
Field
Value
DetailLabelViewText
Branded client that can on-board using certificates for authentication
SigninButtonText
Start
MDK
Step 4Create the MDK Client
+
Make sure you are choosing the right development platform tab above.
Run ./create-client.command to create the client. You will be asked to provide the path to the .mdkproject file. You can also provide optional arguments such as output directory and log verbosity. You can run create-client.command --help to find out how to specify these options as arguments.
MDK
You can run the create-client command from any directory. The resulting MDK client will be created in the directory where the create-client command is run from.
You will be asked whether you would like to build for iOS or android or all?
MDK
All option was chosen in this tutorial as you will learn how to create the MDK client for iOS and Android.
Once the create-client.command script executed successfully, you will see Application ready message in terminal console.
You will also find your MDK Client app created under the MDKClient_SDK folder.
MDK
Run ./create-client.cmd to create the client. You will be asked to provide the path to the .mdkproject file. You can also provide optional arguments such as output directory and log verbosity. You can run create-client.cmd --help to find out how to specify these options as arguments.
MDK
You can run the create-client command from any directory. The resulting MDK client will be created in the directory where the create-client command is run from.
Once the create-client.cmd script executed successfully, you will see Application ready message in terminal console.
MDK
You will also find your app created under the MDKClient_SDK folder.
MDK
This name of this folder is based on the <App Name> provided in the MDKProject.json file and this is the MDK client application generated project.
Step 5Run the MDK Client
+
Make sure you are choosing the right device platform tab above.
In this step, you will Run the Project on an android device. First attach your device to your machine. Then run tns device android command to print a list of attached devices.MDK
Make sure Developer option and USB debugging option is enabled in android device.
Copy the Device Identifier value for your device.
In terminal or command line window, navigate to the app name folder MDKCertApp (in MDClient_SDK path) and use tns run android --device <device identifier> command to run the MDK client on android device.
MDK
Once, above command gets successfully executed, you will see new MDK client up and running in Android device.
Tap Agree on End User License Agreement.
MDK
In Welcome screen, you will notice that app name, detailed label text and signing button text have been updated as per changes done in step 3.4 & 3.6. Tap Start to connect the MDK client to SAP Business Technology Platform (BTP).
MDK
As you enabled the certificate based authentication, MDK client detects a valid certificate installed on the device and connects successfully to the SAP BTP.
MDK
If the user certificate is not valid or not detectable, then you will see an SAP BTP login page.
Choose a passcode with at least 8 characters for unlocking the app and tap Next.
MDK
Confirm the passcode and tap Done.
MDK
If you want your MDK client to send you notification, click Next.
MDK
Optionally, you can enable biometric authentication to get faster access to the app data.
Since no metadata has been deployed yet, you will see a message box suggesting next steps.
MDK
In this step, In this step, you will Run the Project on an iOS device. First attach the device to your Mac. Then run tns device ios command to print a list of attached devices.
MDK
Copy the Device Identifier value for your device.
In terminal window, navigate to the app name folder MDKCertApp (in MDClient_SDK path) and use tns run ios --device <device identifier> command to run the MDK client on iOS device.
MDK
You can also Run the Project in Xcode. Open the project in Xcode with the command open platforms/ios/<app name>.xcworkspace, or open the workspace using the File -> Open... dialog in Xcode. Configure the application’s code signing settings, then Run the project for the target device.
Once, above command gets successfully executed, you will see new MDK client up and running in your device.
Tap Agree on End User License Agreement.
MDK
In Welcome screen, you will notice that app name, detailed label text and signing button text have been updated as per changes done in step 3.4 & 3.6.
MDK
Tap Start to connect the MDK client to SAP Business Technology Platform (BTP). As you enabled the certificate based authentication, MDK client detects a valid certificate installed on the device and connects successfully to the SAP BTP.
MDKMDK
If the user certificate is not valid or not detectable, then you will see an SAP BTP login page.
Choose a passcode with at least 8 characters for unlocking the app and tap Next.
MDK
Confirm the passcode and tap Done.
MDK
Optionally, you can enable biometric authentication to get faster access to the app data, tap Enable.
MDK
Since no metadata has been deployed yet, you will see a message box suggesting next steps.
Share feedback on this tutorial or join the conversation in SAP Community.
Submit detailed feedbackDiscuss in Community
Steps
Step 1 of 5
1. Configure a new MDK application in Mobile Services admin UI2. Modify the default OAuth security settings3. Create your .mdkproject folder4. Create the MDK Client5. Run the MDK Client
Joule
AI Notice
Joule is an AI assistant. Generative AI may produce inaccurate, incomplete, or biased information. Always verify important details before acting on them.
Conversations are sent to SAP-hosted large language models for processing. Do not include personal data, credentials, or confidential information in your messages.
Joule's responses are based on the SAP tutorial catalog and may not reflect the latest product changes. For authoritative guidance, consult the linked tutorials and official SAP documentation.
