Configuring Enrollment SSO with Okta Verify

Jamf Pro Documentation 11.16.0
Solution
Application
Content Type
Technical Documentation
Utilities & Services
version
11.16.0
ft:locale
en-US
vrm_version
11.16.0

Using Okta Verify as an Enrollment SSO app with Jamf Pro requires the configuration of multiple items within Jamf Pro, including Single Sign-On settings, a managed app configuration for the Okta Verify app, and a configuration profile with a Single Sign-on Extension payload configured.

Requirements

  • Okta as an identity provider

  • Okta FastPass authentication enabled for your Jamf Pro app in the Okta dashboard. For details, see Okta FastPass from Okta.
Note:

End users will be guided to set up and register within the Okta Verify app if they select the Sign in with Okta FastPass option when authenticating with Jamf Pro during enrollment. If the user signs in to Okta without selecting Okta FastPass, the Okta Verify app can be set up by the user later, after the device enrolls with Jamf Pro.

  1. In Jamf Pro, click Settings in the sidebar.
  2. In the System section, click Single sign-on .
  3. Select the Enable Single Sign-On for Account-Driven Enrollment checkbox.
  4. Enter the host URL found in your Okta dashboard in the URL field.
  5. Enter the Management Hint found in your Okta dashboard in the Management Hint field.
  6. (Optional) Specify a user group.
  7. Click Save .
  8. In Jamf Pro, click Devices in the sidebar.
  9. Click Mobile Device Apps in the sidebar.
  10. Click New.
  11. Select App Store app or apps purchased in volume and click Next.
  12. Do one of the following:
    • To add the app by browsing the App Store or apps purchased in volume, enter Okta Verify, choose an App Store country and click Next. Then click Add.
    • To add the app by uploading a VPP code spreadsheet, click Choose File and upload the Excel spreadsheet (.xls) that contains VPP codes for the app.
    • To add the app by manually entering information about it, click Enter Manually.
  13. Use the General tab to configure basic settings for the app and select "Install Automatically" from the Distribution Method pop-up menu.
  14. Click the App Configuration tab. Copy and paste the following PLIST into the Preferences field.
    <dict>
    <key>managementHint</key>
    <string>your-secret-key-here</string>
</dict>
    Note:

    Replace your-secret-key-here with the secret key found in your Okta dashboard after enabling Okta FastPass.

  15. Click the Scope tab and configure the scope of the app.
  16. Click Save .
  17. Click Configuration Profiles in the sidebar, and then click New.
  18. Use the General payload to configure basic settings for the profile.
  19. Use the Single Sign-On Extensions payload to configure settings for the profile as follows:
    1. Click Add.
    2. Entercom.okta.mobile.auth-service-extensionin the Extension Identifier field.
    3. EnterOkta Devicein the Realm field.
    4. Enter your host URL in the Hosts field. For example, myorganization.okta.com.
    5. In the Custom Configuration setting section, upload a PLIST that contains the following:
      <?xml version="1.0" encoding="UTF-8"?>
<plist>
  <dict>
    	<key>managementHint</key>
      	<string>your-secret-key-here</string>
  </dict>
</plist>
      Note:

      Replace your-secret-key-here with the secret key found in your Okta dashboard after enabling Okta FastPass.

  20. Click the Scope tab and configure the scope of the profile.
  21. Click Save .