Okta

Jamf Security Cloud Portal Setup Guide
Solution
Application
Jamf Connect
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
Requirements

  • An Okta account

  • A valid Okta administrator account with the Application Administrator role assigned, or a role that includes the same permissions

  • If you have more than 100 groups in Okta, specify the target groups under Devices > Activation Profiles > Identity-Based Provisioning in Jamf Security Cloud.

  1. Create a Jamf SSO app in Okta:
    1. Log in to your Okta admin console.
    2. Navigate to Applications > Applications.
    3. Click Create App Integration.
    4. Select OpenID Connect for your sign-in method.
    5. After selecting OpenID Connect, the menu automatically drops down to the application type.
    6. Select Native Application for your application type.
    7. Click Next.
    8. On the New Native App Integration page that appears, configure the page as follows:

      1. App integration name: Add a user-friendly name (for example, "Jamf End User SSO") and icon.

      2. For Grant type, select Refresh Token. By default, Use persistent token will also be selected after you click Save below.

      3. In the Sign-in redirect URIs fields, enter the required URls based on the platforms in the following table:
        PlatformURl
        iOS / iPadOScom.jamf.trust-auth://login
        Androidwandera-auth://login
        macOScom.jamf.trust-auth://login
        Windowshttp://localhost:4566/
      4. In the Sign-out redirect URIs fields, enter the required URls based on the platforms in the following table:
        PlatformURl
        iOS / iPadOScom.jamf.trust-auth://logout
        Androidwandera-auth://logout
        macOScom.jamf.trust-auth://logout
        WindowsN/A
      5. In the Controlled Access section, select Skip group assignment for now.
        Note:

        This option allows you to skip assignment until after the application has been created.

      6. Click Save.

    9. In the General Settings section, click Edit.
    10. In the User consent section, deselect Require consent.
      Note:

      If this section is unavailable, navigate to Enable consent for scopes in Okta's documentation for additional information.

    11. Click Save.
    12. On the Sign On tab, find the Token claims section, click Show legacy configuration, then click Edit.
    13. For Groups claim filter, change "Starts with" to "Matches regex" .
      Note:

      If you have more than 100 groups in Okta, change "Starts with" to Equals.

    14. Enter .* in the value field.
      Note:

      • If you have more than 100 groups in Okta, enter a group name in the value field. For example, you may have named a group as IT or Zero Trust Network Access

      • When using Identity-Based Provisioning, you can activate devices in different ways, based on a user's Okta group memberships. For more information, see Enabling Identity-Based Provisioning with Jamf Security Cloud.

    15. Click Save.
    16. On the Assignments tab, define the users and groups that are permitted to activate Jamf Security Cloud using their Okta credentials.
      Note:

      Jamf recommends assigning this permission to all users for post-pilot/production deployments, but you may want to assign to individuals initially for testing purposes.

    17. Return to the General tab, and click the Copy to Clipboard icon corresponding to the Client ID.
  2. Create an Okta IdP connection in Jamf Security Cloud:
    1. Sign in to Jamf Security Cloud, then navigate to Integrations > Identity providers.
    2. Under Okta, click Add connection.
    3. Enter a connection name. Jamf recommends using your Okta Org name.
    4. Provide the full hostname of your Okta Organization Domain.

      This is usually in the format company.okta.com or is a custom Okta Org hostname configured in Okta, for example, okta.company.com.

    5. Paste the Client ID, copied from the Okta console in a previous step, into the Client ID field.
    6. Click Test and Save.
    7. Repeat these steps for any other Okta connections as required.

Okta authentication is now configured.

The connection is now available when "Okta" is selected for User Credentials (SSO) in the Authentication section within all defined Activation Profiles.

When users use an Activation Profile linked to an Okta connection, they will be prompted to sign in using Okta.