Syncing with an LDAP Directory Service

Jamf School Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Syncing with an LDAP directory service allows you to do the following:

  • Look up and populate user information from the directory service for inventory purposes.

  • Add Jamf School user accounts or groups from the directory service.

  • Require users to log in during mobile device setup using their LDAP directory accounts.

  • Base the scope of remote management tasks on users or groups from the directory service.

You can sync with the following active directory services with extended support in Jamf School:

  • Google's Secure LDAP

  • IServ

  • JumpCloud
    Note:

    You can also sync with other directory services that are not listed here.

Requirements

To synchronize Jamf School with an LDAP directory service, you must have an LDAP directory service configured. For more information on the respective directory services, see the following documentation:

  1. In Jamf School, navigate to Organization > Settings in the sidebar.
  2. Click the Synchronization payload.
  3. Choose "LDAP" from the Synchronization Method pop-up menu.
  4. (Optional) If you want to ensure the data in Jamf School are up-to-date with the information in your LDAP directory service, configure LDAP automatic synchronization settings from the Automatic synchronization settings pop-up menu.
  5. Enter the LDAP directory service and port in the LDAP Server/Port fields.
  6. Enter the username for the LDAP directory service with the Domain Component in the Username field.
    Example:

    CN=Username,DC=example,DC=com

  7. Enter the password for the LDAP directory service in the Password field.
  8. (Optional) Enter the base DN in the Base DN field to pre-populate OU values.
  9. (Optional) If you do not have OUs in your LDAP directory service, you can sync users directly from the base DN by selecting the Use the base DN for all users checkbox.
  10. (Optional) To refresh the pre-populated OUs, click Retrieve OUs.
  11. (Optional) To retrieve CNs with OUs, select the Retrieve CNs with OUs from your directory service checkbox.
    Note:

    Retrieval time may increase depending on the number of CNs in your directory service.

  12. If your directory service maps groups from teacher and student users, do the following:
    1. Enter the Organizational Unit where the student users are located in the OU of students field.
      Example:

      OU=Students,OU=Accounts,DC=ad,DC=School,DC=nl

      Note:

      To sync users from a group instead of the OU, you can also specify the CN. For example: CN=Group,OU=Students,OU=Accounts,DC=ad,DC=School,DC=nl

    2. (JumpCloud only) If you want to sync student users from groups and the users are located in a different OU than the OU of students field, enter the CN of the student group in the OU of student group members field.
      Note:

      If this field is left blank, Jamf School uses the final value of the CN in the OU of students field.

    3. Enter the Organizational Unit where the teacher users are located in the OU of teachers field.
      Example:

      OU=Teachers,OU=Accounts,DC=ad,DC=School,DC=nl

      Note:

      To sync users from a group instead of the OU, you can also specify the CN. For example: CN=Group,OU=Teachers,OU=Accounts,DC=ad,DC=School,DC=nl

  13. If your directory service maps teacher and student users from groups, enter the OU of the groups in the OU of groups field.
    Example:

    OU=Groups,OU=Accounts,DC=ad,DC=School,DC=nl

  14. To verify if the directory service username and password you entered is correct, click Test Connection.
  15. Configure LDAP mapping parameters.
  16. To map the group based on the user, enter a value in the Member Of field.
    Example:

    memberOf

  17. To map the user to their security identifier (SID), enter a value in the User Security Identifier (SID) field.
    Example:

    objectSid

  18. To map the user based on the group, enter a value in the Group Membership field.
    Example:

    member

  19. To add an additional attribute key for group names, enter a value in the Group Name field.
    Example:

    cn

  20. (Optional) To test your CN mapping configuration before saving, click Test Mapping Configuration and then enter the group and user OUs you want to test in the LDAP Mapping Configuration Test pop-up modal.
  21. (Optional) If the LDAP directory service will be syncing 1,000 or more user records with Jamf School, select the Enable paging checkbox.
  22. (Optional) To search for groups in all groups in the OU, select the Enable recursive groups checkbox.
  23. (Optional) To disable the automatic deletion of user accounts removed from the directory service, deselect the Delete Removed Users checkbox.
  24. (Google's Secure LDAP only) Select the Authenticate using a client certificate checkbox, and then upload the custom certificate and custom key generated in Google's Secure LDAP.
  25. Click Save.

If configured, information from the LDAP directory service syncs daily with Jamf School during the selected time. Users imported from an LDAP directory service have a value of "LDAP" for the source on the user overview in Jamf School.