Deploying the Kerberos Single Sign-on Extension with Jamf Pro

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

You can use Jamf Pro to deploy Kerberos-based single sign-on (SSO) to managed devices. This simplifies the process of acquiring a Kerberos ticket-granting ticket (TGT) from your organization's Active Directory domain, allowing users to seamlessly authenticate to on-premise resources like websites, apps, and file servers.

Requirements

  • An Active Directory domain running on a server with Windows Server 2008 or later. For information on binding computers to an Active Directory domain, see Directory Bindings in the Jamf Pro Documentation.

    Note:

    The Kerberos SSO extension is not intended for use with Azure Active Directory (Entra ID). It requires a traditional, on-premises Active Directory domain.

  • Target devices must have network access to the Active Directory domain. This access can be provided through Wi-Fi, ethernet, or VPN.

  1. In Jamf Pro, navigate to Computers or Devices, and then click Configuration profiles.
  2. Click New.
  3. In the General payload, enter a display name for the profile and configure any additional general settings as needed.
  4. In the left-hand payload list, click Single Sign-on Extensions.
  5. Click the Add button.
  6. Configure the following settings in the Single Sign-On Extensions payload:
    1. Under Payload Type, select the Kerberos radio button.
    2. In the Realm field, enter the name of your Active Directory domain in upper case (e.g., EXAMPLE.COM).
      Note:

      Do not enter the name of your Active Directory forest unless your user accounts reside at the forest level.

    3. Under Hosts, use the +Add button to add domains for any resources that use Kerberos authentication. For example, if resources reside in us.example.com, enter .us.example.com.
      Note:

      Ensure each entry includes a leading period.

    4. (Optional) Enable the Automatic Login toggle and select the Allow radio button to store the user's password in their keychain, enabling silent TGT acquisition.
    5. (Optional) (macOS only) Select the Allow Password Change toggle to open a password change website in the default browser when the user selects "Change Password" or acknowledges a password expiration notice.
    6. (Optional) (mobile devices only) To require users to use Face ID, Touch ID, or passcode, select the User presence to access the keychain entry toggle and the Require radio button.
    7. (Optional) To allow the extension to automatically determine your Active Directory site, select the Automatically use LDAP and DNS to determine the Kerberos extension's AD site name toggle and the Enforce radio button.
    8. (Optional) Select the Credential Bundle IDACL toggle and use the + Add button to add the bundle IDs of applications that are permitted to access the TGT.
    9. (Optional) Select the Domain Realm Mapping toggle and use the + Add button to add a custom domain-realm mappings.
    10. (Optional) To add a principal name for the extension, select the The principal/username toggle and enter a name in the field.
    11. (Optional) (iOS/iPadOS only) Select the Managed apps in bundle IDACL toggle and the Enforce radio button to restrict access to the TGT so that only managed applications with matching bundle IDs can use it.
    12. (Optional) To specify the Active Directory site the Kerberos extension should use to locate a nearby domain controller, enter a name in the Site Code field.
  7. Click the Scope tab and configure the targets for this profile by adding devices or groups.
  8. Click Save.

The profile is deployed, enabling the Kerberos single sign-on extension for target devices.