Add Groups Claim to OIDC Identity Tokens

Jamf Connect Documentation
Solution
Application
Jamf Connect
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Optionally, groups can be used to determine if a user should become a user with administrator rights on a local macOS account or to determine if a user is allowed to make additional user accounts on a device with the Admin Roles (OIDCAdmin) and Secondary Access Group (OIDCSecondaryAccess) respectively.

Requirements

  • Access to your organization's Okta Identity Engine or Okta Classic Engine admin console.

  • An existing Okta app integration with OpenID Connect 2.0.

  1. Log in to the Okta Admin Console.
  2. Navigate to Applications.
  3. Select your Jamf Connect application.
  4. Navigate to OpenID Connect ID Token in the Sign in tab.
  5. Click Edit.

    An OpenID Connect identity token can contain up to 100 groups. If your organization has users that belong to more than 100 groups, use Okta's filtering options.

  6. To send all Okta groups:
    1. Set Groups claim type to Filter.
    2. In the Group claims filter, set the name of the claim to groups. Set the filter type to Matches regex. Set the filter expression to .*.
    3. Click Save.
  7. To send all Okta and linked on-premises Active Directory groups:
    1. Set Groups claim type to Expression.
    2. In the Group claims filter, set the name of the claim to groups. Set the expression to Arrays.isEmpty(Arrays.toCsvString(Groups.startsWith("active_directory","",100))) ? Groups.startsWith("OKTA","",100) : Arrays.flatten(Groups.startsWith("OKTA","",100),Groups.startsWith("active_directory","",100)).
    3. Click Save.
  8. In your Jamf Connect configuration, the OpenID Connect Scopes (OIDCScopes) setting must be set to openid profile email groups. (Okta requires space delimiters in the scope request)

Your Okta OIDC configuration can now determine if a user should become a user with administrator rights on a local macOS account or to determine if a user is allowed to make additional user accounts on a device through Okta and Active Directory groups.

For more information about Okta Expression Language filters, see Group functions (okta Developer).