AuthServer

Specifies your Okta authentication domain

<key>AuthServer</key>

<string>yourcompany.okta.com</string>

CreateAdminUser

If set to true, all new users become local administrators on the computer.

<key>CreateAdminUser</key>

<false/>

CreateSyncPasswords

Determines if a keychain entry is created for Jamf Connect Sync

<key>CreateSyncPasswords</key>

<false/>

DemobilizeUsers

Determines if any existing Active Directory mobile accounts are "demobilized", which is the process of converting a mobile account into a local account. Demobilization also removes the network authentication authority from the account.

Once demobilized, you can unbind the Mac from Active Directory.

<key>DemobilizeUsers</key>

<false/>

DenyLocal

Determines if users can bypass network authentication and use local authentication at the login window.

If set to true, users must log in with Okta and have a network connection.

If set to false, users can log in without Okta or a network connection.

<key>DenyLocal</key>

<false/>

DenyLocalExcluded

Specifies which local users can still use local authentication if the DenyLocal key is also to true.

<key>DenyLocalExcluded</key>

<array>

<string>admin</string>

<string>ladmin</string>

</array>

LicenseFile

The contents of a .jamfconnectlicense file encoded in Base64 data format

<key>LicenseFile</key>

<data>encoded-license-content</data>

LocalFallback

Used with DenyLocal to force authentication to Okta first, but then fallback to local auth if Okta is unavailable.

<key>LocalFallback</key>

<false/>

Migrate

Allows local accounts to be migrated to Okta-based accounts.

This is typically used when the user account was already created on the system, but you want the accounts to have the same username and password as the user’s Okta identity.

Jamf Connect Login does this by forcing the user to sign in via Okta, and then attempts to match the user with an existing local account. Consider the following user migration scenarios:

• If a user's Okta username and password match a local username and password, the account is considered migrated. No additional steps are needed.

• If a user's Okta username matches a local username but the passwords do not match, the user will be prompted to enter their current local password. Once successfully entered, Jamf Connect Login will use the current local password and the current Okta password to sync the account to the current Okta password.

• If a user's Okta username does not match any local account, the user will be given the option to create or migrate a local account. To migrate an account, the user must provide the existing local password. At this point Jamf Connect Login will synchronize the password to the Okta password, and then add the Okta username as an alias to the local account. This way the user can sign in to the system as their Okta username.

Additionally, Okta can migrate users from local accounts to accounts associated with an Okta identity. With the Migrate and DenyLocal preference keys, all subsequent sign-ins will be authenticated to Okta, and then the system verifies if the user record has an “OktaUser” attribute. If this attribute cannot be verified, the user will be asked to select a local account to associate with the user’s Okta account. If the local account shortname does not match the Okta shortname, the Okta name will be added as an alias to the account so the user will be able to use either one. This also keeps the home folder path and other elements of the user record the same.

<key>Migrate</key>

<false/>

MigrateUsersHide

Specifies which local accounts are excluded from the migration pull-down menu

<key>MigrateUsersHide</key>

<array>

<string>admin</string>

<string>ladmin</string>

</array>

UIDTool

Specifies a path to a UID tool that allows you to set a local user account's UID to a custom value during account creation. This can be used to match a local user account's UID with a user's LDAP UID attribute. Your UID tool must be an executable script.

<key>UIDTool</key>

<string>/Users/Shared/UIDTool</string>

OIDCAuthServer

Specifies a custom authorization server in your Okta tenant, which can be used to send custom scopes and claims in a user’s ID token during local account creation.

For more information about creating a custom authorization server, see the following resource from Okta: https://developer.okta.com/docs/guides/customize-authz-server/overview/

<key>OIDCAuthServer</key>

<string>yourcompany.okta.com</string>

OIDCAccessClientID

OIDC application that determines which users can access the computer

<key>OIDCAccessClientID</key>

<string>0oad0gmia54gn3y8923h1</string>

OIDCAdminClientID

OIDC application that determines which users are created with local administrator accounts.

<key>OIDCAdminClientID</key>

<string>0oa0gwese54gn3y9O0h4</string>

OIDCIgnoreCookies

Ignores any cookies stored by the loginwindow

<key>OIDCIgnoreCookies</key>

<false/>

OIDCSecondaryLoginClientID

OIDC application that determines who can create local user accounts after an initial user has been created.

<key>OIDCSecondaryLoginClientID</key>

<string>0oa0grdsrhdsre54gn3y9O0h4</string>

OIDCRedirectURI

The redirect URI used by your Jamf Connect app in Okta.

"jamfconnect://127.0.0.1/jamfconnect" is recommended by default, but any valid URI value may be used as long as the configured value in Okta matches the value in your Jamf Connect Login configuration profile.

If you are using OpenID Connect authentication rather than Okta's authentication API, use "https://127.0.0.1/jamfconnect" or a similarly formatted URI.

<key>OIDCRedirectURI</key>

<string>jamfconnect://127.0.0.1/jamfconnect</string>

OIDCTenant

Specifies the Tenant ID for your organization that is used for authentication.

This key is required if you choose to use OpenID Connect authentication rather than Okta's authentication API. For an example PLIST file that configures Okta to use OpenID Connect authentication, see Example Configuration Profiles.

<key>OIDCTenant</key>

<string>your-company-tenant</string>

OIDCShortName

Specifies which attribute from a user's ID token to use as the account short name. The short name is added as an alias to the user's local account.

<key>OIDCShortname</key>

<string>given_name</string>

OIDCScopes

Specifies custom scopes, which return additional claims in a user’s ID token during authorization. Standard scopes included openid, profile, and offline_access. This key should be configured as a string with space-separated values.

<key>OIDCScopes</key>

<string>openid profile</string>

OIDCIDTokenPath

Specifies the file path that can be used to store a user’s formatted ID token.

<key>OIDCIDTokenPath</key>

<string>/tmp/token</string>

OIDCIDTokenPathRaw

Specifies the file path that can be used to store a user’s raw ID token.

<key>OIDCIDTokenPathRaw</key>

<string>/tmp/token-raw</string>

AuthUIOIDCProvider

Identity Provider (PAM)

Specifies the identity provider to use for authentication via the Pluggable Authentication Module (PAM)

<key>AuthUIOIDCProvider</key>

<string>insert-identity-provider</string>

AuthUIOIDCClientID

Client ID (PAM)

The client ID of the created Jamf Connect app in your identity provider used for authentication via PAM

<key>AuthUIOIDCClientID</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

AuthUIOIDCRedirectURI

Redirect URI (PAM)

The redirect URI used by the created Jamf Connect app in your identity provider

<key>AuthUIOIDCRedirectURI</key>

<string>https://127.0.0.1/jamfconnect</string>

AuthUIOIDCTenant

Tenant ID (PAM)

The tenant in your identity provider used for authentication via PAM

<key>AuthUIOIDCTenant</key>

<string>dev-123456</string>

AuthUIOIDCClientSecret

Client Secret (PAM)

The client secret of your Jamf Connect app in your IdP. This value is only known by Jamf Connect and your IdP.

<key>AuthUIOIDCClientSecret</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

EnableFDE

Enable FileVault

If set to true, FileVault will be enabled for the first user that logs in to a computer.

<key>EnableFDE</key>

<false/>

EnableFDERecoveryKey

Save FileVault Recovery Key

If set to true, Jamf Connect will store the FileVault recovery key to /var/db/NoMADFDE unless otherwise specified.

<key>EnableFDERecoveryKey</key>

<false/>

EnableFDERecoveryKeyPath

Set Recovery Key Filepath

Specifies a custom file path for the FileVault recovery key

<key>EnableFDERecoveryKeyPath</key>

<string>/usr/local/filevault</string>

EULAPath

Audit Filepath

Specifies the file path to a directory where user’s end acceptance of a EULA is stored as log files.

<key>EULAPath</key>

<string>/usr/local/shared/EULA.txt</string>

EULAText

EULA Text

Text used for the EULA

<key>EULAText</key>

<string>Insert EULA text here</string>

EULATitle

EULA Text

Title of the EULA text

<key>EULATitle</key>

<string>User Agreement</string>

EULASubTitle

EULA Subtitle

Subtitle of the EULA text

<key>EULASubTitle</key

<string>Terms and Conditions</string>

BackgroundImage

Path to a locally stored image to use as a background for the login window

<key>BackgroundImage</key>

<string>/usr/local/shared/background.jpg</string>

BackgroundImageAlpha

The alpha value of the vibrancy layer blur above the background image as an Int from 0-10, representing the alpha value in 10% increments (e.g., a value of 8 would configure the vibrancy layer blur to be 80% alpha)

<key>BackgroundImageAlpha</key>

<integer>10</integer>

LoginLogo

Path to a locally stored image to use as a logo during password validation or local password creation

<key>LoginLogo</key>

<string>/usr/local/shared/logo.png</string>

LoginScreen

Determines if Jamf Connect Login displays a macOS style login screen instead of a window.

<key>LoginScreen</key>

<false/>

MessageOTPEntry

Text displayed when a user must enter a one time password (OTP) as a multi-factor authentication (MFA) method.

<key>MessageOTPEntry</key>

<string>Enter your verification code.</string>

AllowNetwork Selection

Allow Network Selection

When set to true, this preference key allows users to configure and confirm their network connection preferences from the login window. To access this feature when enabled, users can click Network Connection in the bottom-right corner of the login window.

<key>AllowNetworkSelection</key>

<false/>

HelpURL

Help URL

Specify a URL to display at the login window that directs user's to a resource for onboarding or enrollment help.

<key>HelpURL</key>

<string>yourcompany.help.com</string>

HelpURLLogo

Help Icon

Add a custom image to use as a clickable logo for the Help URL.

<key>HelpURLLogo</key>

<string>/usr/local/shared/helplogo.png</string>

LocalHelpFile

Backup Help File

A path to a local file that users can access by clicking the "Help" button in the Jamf Connect Login window. This file is only displayed if the computer cannot connect to the internet and access the URL specified with the HelpURL key.

<key>LocalHelpFile</key>

<string>/usr/local/shared/JamfConnectHelp.pdf</string>

ScriptArgs

Script Arguments

The arguments used with a specified script run by the RunScript mechanism

<key>ScriptArgs</key>

<array>

<string>-v</string>

<string>-user</string>

</array>

ScriptPath

Script Path

Specifies the path to the script or other executable run by the RunScript mechanism. Only one script can be used with Jamf Connect Login at any time.

<key>ScriptPath</key>

<string>/usr/local/bin/login</string>