Handle iOS Entitlements issues

iOS app entitlements is a permission system that grants app’s executable(.ipa) with particular capabilities such as receiving Push Notifications, Universal Links, App Groups, etc. These entitlements are enabled in your Apple developer account and in your iOS app build. iOS run time policy verifies entitlements enabled in the provisioning profile and the app before granting requisite permission to the app executable.

Issue

We resign your iOS app with BrowerStack’s wildcard provisioning profile to install it on our iOS devices. Resigning an iOS app results in the removal of certain entitlements such as App Groups, Push Notifications, Associated Domains, etc.

In the resigned app, if you invoke any workflow in the app that requires entitlements, which are not supported on BrowserStack App Automate, your app might crash or behave incorrectly. After app resigning, only the following entitlements are supported :

get-task-allow
application-identifier
team-identifier
com.apple.token
keychain-access-groups

Note: For keychain-access-groups entitlement, ensure that Bundle Seed ID/Team ID component of the keychain access groups are read programmatically from the access group attribute (i.e. kSecAttrAccessGroup) of an existing KeyChain item. This is because after resigning Bundle Seed ID/Team ID changes. For more details, please check with your iOS development team.

We do not support other iOS app entitlements on BrowserStack App Automate after iOS app resigning.

Workarounds

Install iOS apps without resigning
Creating app’s build without entitlements dependency

Install iOS apps without resigning

If your iOS app is signed with an Apple enterprise provisioning profile and you pass BrowserStack Appium capability browserstack.resignApp : false, resigning step is skipped and app entitlements are preserved.

However, note that you will not be able to use app webview automation if BrowserStack app resigning is set to false. This is because get-task-allow entitlement, which is required for webview automation, is not supported in the enterprise provisioning profile by iOS.

Creating app’s build without entitlements dependency

Create your app’s build without any dependency on iOS entitlements to upload on BrowserStack App Automate. For more details, please check with your iOS app development team.