Is it possible to renew provisioning profiles without needing to upgrade iOS enterprise apps?

Question

A newly generated provisioning profile no longer seems to be compatible with older versions of the same app. The new app does work with the new profile, however we do not want to upgrade all apps which are linked to older version backends and are not all compatible with the newest app. We do need to renew the profiles shortly in order to keep the old apps working. We have done this before, but now we are having the following issues.

When opening the app with an updated provisioning profile, it fails with this message in the console log:

entitlement 'com.apple.developer.team-identifier' has value not permitted by provisioning profile 'My Profile'

When examining the profile, it turns out that the array containing team identifiers is now no longer an array, but a single element.

Previous provisioning profile:

<key>com.apple.developer.team-identifier</key>
<array>
    <string>SomeIdentifier</string>
</array>

Renewed provisioning profile:

<key>com.apple.developer.team-identifier</key>
<string>SomeIdentifier</string>

Is it possible to add a team identifier to an iOS provisioning profile? That way it would become an array again.

In the Xcode project, I was able to find the team identifier in two places. In the pbxproj file and in a certificate. It doesn't look like it is possible to add any identifiers in the project for the same target since it's a key-value pair style assignment.

I also tried to hack the new provisioning profile and just wrap the array tags around the item (hoping it would fall outside the signature scope). Unfortunately Xcode crashes when I try to install the hacked profile to a device (probably does not handle signature exceptions).

Any way to add an identifier or an other way to get a renewed profile compatible would be greatly appreciated.

Answer 1

I don't think there is any way to edit provisioning profile the way you are looking. If there is then it will be Apple security breach.

Early days, We had same issues with our Enterprise Apps where App stopped opening for all our users - and the problem was certificate expired. I couldn't find to renew on the fly for Enterprise Apps like we do for AppStore Apps.

I had to automate process of creating same IPA with renewed certificate through Jenkins and storing it on server, App picks up new binary automatically and ask users to upgrade it.

If you can find out any other good way - I would be interested :-)