Configuring OIDC-Based SSO with Jamf Connect

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Jamf Connect is a Jamf product that authenticates users at the macOS Login Window using a third-party identity provider (IdP). RapidIdentity acts as the OpenID Connect (OIDC) IdP, allowing Jamf Connect to authenticate users with their RapidIdentity credentials.

Requirements
  • RapidIdentity administrator credentials
  • Access to your RapidIdentity administrator portal
  1. Log in to your RapidIdentity administrator portal.
  2. From the module selector, choose Configuration.
  3. Click Security.
  4. In the left sidebar, navigate to Identity Providers > Federation Partners.
  5. At the top-right of the page, navigate to Add Federation Partner > OpenID Connect.
  6. Click General, then enter the following:
    1. In the Name field, enter Jamf Connect.
    2. In the Description field, enter the Jamf Connect application description.
    3. In the Callback URLs field, enter https://127.0.0.1/jamfconnect.
  7. Click OpenID Connect Configuration, then do the following:
    1. Select the Sign ID Token (RSA with SHA-256) checkbox.
    2. In the Encryption Method field, enter A128CBC_HS256.
    3. Select the Enable Resource Owner Password Grant (ROPG) checkbox.

      The Enable Resource Owner Password Grant (ROPG) panel opens on the right side of the page.

    4. Click Yes.
  8. Click Claim Attributes and add the Email claim attribute.
    1. Click Add Attribute.
    2. Configure the following fields:
      SettingValue
      NameEmail
      DescriptionSends the LDAP mail Attribute
      ClaimEmail
      Claim TypeString
      Attribute Value TypeLDAP
      LDAP Attribute Fieldmail
      Single ValuedSelected
    3. Click Add.
  9. Add the Role claim attribute.
    1. Click Add Attribute.
    2. Configure the following fields:
      SettingValue
      NameRole
      DescriptionSends the LDAP idautoPersonEmployeeTypes Attribute
      ClaimRole
      Claim TypeString
      Attribute Value TypeLDAP
      LDAP Attribute FieldidautoPersonEmployeeTypes
      Single ValuedDeselected (to send multiple roles)
    3. Click Add.
  10. Add the First claim attribute.
    1. Click Add Attribute.
    2. Configure the following fields:
      SettingValue
      NameFirst
      DescriptionSends the LDAP givenName Attribute
      Claimfirst
      Claim TypeString
      Attribute Value TypeLDAP
      LDAP Attribute FieldgivenName
      Single ValuedSelected
    3. Click Add.
  11. Add the Last claim attribute.
    1. Click Add Attribute.
    2. Configure the following fields:
      SettingValue
      NameLast
      DescriptionSends the LDAP sn Attribute
      Claimlast
      Claim TypeString
      Attribute Value TypeLDAP
      LDAP Attribute Fieldsn
      Single ValuedSelected
    3. Click Add.
  12. On the bottom bar, click Save to create the federation partner definition.

Your RapidIdentity portal now has a complete federation partner integration with Jamf Connect.