{
    "properties": {
        "Kerberos": {
            "default": {},
            "description": "Kerberos-related information.",
            "properties": {
                "AppIdentifierMatches": {
                    "description": "List of app identifiers that are allowed to use this login. If this field missing, this login matches all app identifiers.",
                    "items": {
                        "description": "Exact or partial bundle ID match using the wildcard character eg com.apple.*",
                        "type": "string"
                    },
                    "type": "array"
                },
                "PayloadCertificateUUID": {
                    "description": "The PayloadUUID of an identity certificate payload that can be used to renew the Kerberos credential without user interaction.\n                            The certificate payload must have either the com.apple.security.pkcs12 or com.apple.security.scep payload type.\n                            Both the Single Sign On payload and the identity certificate payload must be included in the same configuration profile",
                    "pattern": "^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$",
                    "type": "string"
                },
                "PrincipalName": {
                    "description": "The Kerberos principal name. If not provided, the user is prompted for one during profile installation. This field must be provided for MDM installation.",
                    "type": "string"
                },
                "Realm": {
                    "description": "The Kerberos realm name. This value should be properly capitalized.",
                    "type": "string"
                },
                "URLPrefixMatches": {
                    "description": "List of URLs prefixes that must be matched to use this account for Kerberos authentication over HTTP. Note that the URL postfixes must match as well.",
                    "items": {
                        "description": "Each entry in the URLPrefixMatches array must contain a URL prefix. Only URLs that begin with one of the strings in this account are allowed to access the Kerberos ticket.",
                        "type": "string"
                    },
                    "type": "array"
                }
            },
            "type": "object"
        },
        "Name": {
            "description": "Human-readable name for the account.",
            "type": "string"
        },
        "PayloadDescription": {
            "default": "Single Sign-On Account Payload",
            "description": "Description of the payload",
            "type": "string"
        },
        "PayloadDisplayName": {
            "default": "Single Sign-On Account Payload",
            "description": "Name of the payload",
            "type": "string"
        },
        "PayloadIdentifier": {
            "default": "com.apple.sso",
            "description": "A unique identifier for the payload, dot-delimited.  Usually root PayloadIdentifier+subidentifier",
            "type": "string"
        },
        "PayloadOrganization": {
            "description": "This value describes the issuing organization of the profile, as displayed to the user",
            "type": "string"
        },
        "PayloadType": {
            "default": "com.apple.sso",
            "description": "The type of the payload, a reverse dns string",
            "type": "string"
        },
        "PayloadUUID": {
            "default": "",
            "description": "Unique identifier for the payload (format 01234567-89AB-CDEF-0123-456789ABCDEF)",
            "pattern": "^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$",
            "type": "string"
        },
        "PayloadVersion": {
            "default": 1,
            "description": "The version of the whole configuration profile.",
            "type": "number"
        }
    },
    "title": "com.apple.sso",
    "type": "object"
}