authchanger

Jamf Connect Documentation
Solution
Application
Jamf Connect
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

The authchanger command-line tool can be used to manipulate the authentication database used by the macOS loginwindow application. Functions include the following:

  • Determine the order of mechanism execution.

  • Enable Jamf Connect for Okta or OpenID Connect authentication with a cloud identity provider (IdP).

  • Reset the database to the default state.

  • Run a single Jamf Connect mechanism during the loginwindow process, such as the demobilize mechanism.

  • Configure Jamf Connect to run a script after the authentication process.

authchanger commands can be executed from the following file path:

/usr/local/bin/authchanger

You can use the authchanger to set up the authentication database for authentication with Jamf Connect in any of the following ways:

  • Execute authchanger commands via a postinstall script in the login window installer package.
Note:

  • This tool must run as root to make database changes.

  • Use the -reset command before making changes to ensure the authentication database is in its default setting.

  • Execute authchanger commands manually at the command-line.

  • Include authchanger arguments in a configuration profile written to the com.jamf.connect.authchanger domain. Jamf Connect will look for authchanger arguments as an array of strings in the Arguments key and read them in the order in which the strings are configured, similar to how they are ordered in the command-line.

The Jamf Connect installer does not add any arguments to authchanger by default.

Jamf Connect will look for authchanger arguments in the following order after the login window is installed:

  1. Commands executed via the command-line. Consider the following scenarios:

    • If a command is executed with arguments, any preferences found in a configuration profile will be ignored.

    • If a command is executed without arguments, Jamf Connect will look for preferences in a configuration profile.

  2. Preferences found in a configuration profile written to com.jamf.connect.authchanger

  3. The Identity Provider (OIDCProvider) or Auth Server (AuthServer) preferences written to the com.jamf.connect.login domain. These pass the -JamfConnect argument to automatically enable OpenID Connect or Okta authentication.

  4. If no arguments or preferences are found, the default loginwindow mechanisms will remain unchanged.