Enabling Single Sign-On in Jamf Pro - Technical Paper: Customizing the Jamf Pro Enrollment Experience Using Enrollment Customization and Jamf Connect

Technical Paper: Customizing the Jamf Pro Enrollment Experience Using Enrollment Customization and Jamf Connect
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

To enable single sign-on (SSO), you must configure settings in both your IdP's console and Jamf Pro.

This allows you to add the Single Sign-On PreStage Pane to an Enrollment Customization configuration.

Configuring settings for your IdP must be completed before you enable SSO in Jamf Pro. In some environments, simultaneous configuration between your IdP and Jamf Pro is required.

Note:

Enabling SSO for Jamf Pro services and applications prevents users from authenticating with all other user credentials. Jamf recommends that you notify users about changes to the authentication experience in your organization, when enabled.

Requirements

  • Integration with an identity provider (IdP) that supports SAML 2.0 protocols. For more information, see the following:

  • Two-way communication on TCP ports between the IdP and the Jamf Pro server

  • Jamf Pro user accounts or groups with matching IdP usernames or groups

  • Administrator privileges to Jamf Pro and your IdP

  • If leveraging the failover URL for local account access, and SSO is enabled, the configured Jamf Pro account will need both read and update privileges for SSO

  1. In Jamf Pro, click Settings in the sidebar.
  2. In the System section, click Single sign-on .
  3. Click Edit .
  4. Click the Enable Single Sign-On Authentication switch to enable the configuration.
    Note:

    In the Failover Login URL box, click Copy to clipboard, and then save the failover login URL to a secure location. This URL will allow you to log in using your Jamf Pro credentials after SSO is configured and enabled. If you have created an SSO integration prior to 10.45.0, the failover login URL will remain unchanged until you click the Regenerate button.

  5. Choose your IdP from the Identity Provider pop-up menu.

    If your IdP is not listed, choose "Other" and enter your IdP's name in the Other Provider field. The Entity ID field is pre-populated by default (e.g., "https://JAMF_PRO_URL.jamfcloud.com/saml/metadata").

    Note:

    For most IdPs, the Entity ID value should match the Audience URI value in the IdP's configuration settings.

  6. Click an option to configure the Identity Provider Metadata Source setting:
    • Metadata File —Allows you to upload a metadata file in .xml format.
    • Metadata URL —You must obtain this URL from your IdP's configuration settings (e.g., the "Audience URI" or "Audience Restriction").
  7. (Optional) Enable the Token Expiration Time Override if you need to override the default token expiration period specified by your IdP.

    When enabled, the value in minutes determines the amount of time before the SAML token expires. The field is pre-populated with the default value determined by your selected IdP. If you override the default value, you must ensure the new value matches the token expiration settings configured in your IdP.

    The Token Expiration Time Override setting is set to Disabled by default. This means the default expiration time provided by your IdP is used.

    Important:

    If your IdP is Azure, Google Workspace, or Okta, Jamf Pro users or end users using enrolled devices may encounter login errors if the Token Expiration Time Override setting is enabled. To prevent these errors, you may want to disable the Token Expiration Time Override setting. This will stop Jamf Pro from verifying the token's lifetime, which is controlled and verified by your IdP. Alternatively, you can ensure that the token expiration time set in Jamf Pro exceeds the expiration time configured by your IdP. However, issues may still occur if the token expiration time dynamically changes.

  8. Click an option to configure the Identity Provider User Mapping setting to define which attribute from the SAML token should be mapped to Jamf Pro users:
    • NameID —This is the default attribute name.
    • Custom Attribute —Allows you to enter a custom attribute name that is included in the SAML token sent from the IdP.
  9. Click Username or Email for Jamf Pro User Mapping.

    These options determine how users in your IdP will be mapped to Jamf Pro users. By default, Jamf Pro gets information about the user from the IdP and matches it with existing Jamf Pro user accounts. If the incoming user account does not exist in Jamf Pro, then group name matching occurs.

  10. Enter the SAML assertion attribute that defines users in the IdP in the Identity Provider Group Attribute Name field.

    Jamf Pro matches each group from the Jamf Pro database and compares group names. Each user will be granted access privileges from all of the groups in the same manner as a local Jamf Pro user would. AttributeValue strings may be formatted as multiple strings, a single string, or semicolon-separated values.

    Example:http://schemas.xmlsoap.org/claims/Group
  11. (Optional) Use the RDN Key for LDAP Group field to extract the name of the group from strings sent in LDAP format, Distinguished Names (DN).

    Jamf Pro searches the incoming string for a Relative Distinguished Name (RDN) with the specified key and use the value of the RDN Key as an actual name of the group.

    Note:

    If the directory service string contains several RDN parts with the same key (e.g., CN=Administrators, CN=Users, O=YourOrganization), Jamf Pro will extract group names from the left-most RDN Key (e.g., CN=Administrators). If you leave the RDN Key for LDAP Group field blank, Jamf Pro will use the entire LDAP format string.

  12. (Optional) Click the Security checkbox and click a Jamf Pro Signing Certificate option to establish secure SAML communication with a certificate:
    • Generate Certificate —Allows you to generate a signing certificate if you are not providing your own. Click Generate and a signing certificate will be automatically generated.
    • Upload Certificate —Allows you to upload your own signing certificate. If you are uploading the Jamf Pro Signing Certificate, upload a signing certificate keystore (.jks or .p12) with a private key to sign and encrypt SAML tokens, enter the password to the keystore file, select a private key alias, and then enter the key password.
    Note:

    For some IdP's, you may need to download the certificate and include it in your IdP configuration settings.

  13. (Optional) Click Single Sign-On Options for Jamf Pro to configure the following additional options:
    • Allow users to bypass the Single Sign-On authentication —

      Allows users to sign in to Jamf Pro without SSO, if they directly navigate to the Jamf Pro URL. When a user tries to access Jamf Pro via your IdP, SSO authentication and authorization still occurs.

    • Enable Single Sign-On for Self Service for macOS —Allows users to sign in to Self Service via the IdP login page. Self Service is able to access any existing usernames from the IdP.
      Note:

      • Enabling this option automatically changes the Authentication Type in Settings > Self Service > macOS > Login to Single Sign-On.

      • Disabling this option automatically changes the Authentication Type in Settings > Self Service > macOS > Login to Directory Service account or Jamf Pro user account.

    • Enable Single Sign-On for User Authentication during Enrollment —

      Allows users to enroll via the login page of their identity provider during user-initiated enrollment, Account-Driven User Enrollment, and Account-Driven Device Enrollment. When enabled, the username at the IdP login page will be the username Jamf Pro uses for the Username field in the User and Location category during an inventory update for a computer or mobile device. You can click Any identity provider user to allow access to all users in your IdP, or click Only this group to restrict access to a select group of users.

      Note:

      • If Directory Service is integrated with Jamf Pro, the User and Location information will be fully populated using a lookup from Jamf Pro to Directory Service.

      • If Directory Service is not integrated with Jamf Pro, the Username field will be the only item populated in the User and Location category. User lookup will not work during enrollment.

  14. Click Save .
  15. (Optional) Click Download to download the Jamf Pro metadata XML file.
    Some IdPs require the metadata file to properly configure SAML. The file contains several important URLs that let the IdP know where to send a user, as well as how to verify to Jamf Pro.

    • EntityDescriptor: jamfproURI/saml/metadata

    • SingleLogoutService: jamfproURI/saml/SingleLogout

    For other IdPs, minimal metadata is required without the need for the metatdata file. This allows for quicker setup since all required information will be provided in the system automatically.

Users are now automatically redirected to your organization's IdP login page to access configured portions of Jamf Pro.