You can install Jamf Connect Login with the signed package installer provided by Jamf. This package is signed by a valid Apple Developer identity and will install Jamf Connect Login in the following location:
The package also installs the authchanger and Pluggable Authentication Module (PAM) binary tools in the following locations:
The authchanger tool runs at the end of the installation, which updates the authorization database and enables Jamf Connect Login.
For more information about the authchanger and PAM, see Authentication Tools.
You can use the package installer with multiple macOS management tools that allow package deployment. After installation, users can view the loginwindow interface. Restarting the computer is not required.
Note: If you would like to use a non-standard authorization rule set, you can rebuild the package without the authchanger binary and supply your own method for updating the authorization database.
You can deploy Jamf Connect Login to target computers in your environment using your preferred MDM solution.
Note: This workflow assumes you have met the general requirements for Jamf Connect. For more information, see General Requirements and IdP Compatibility.
Open the Jamf Connect DMG and download the following packages:
Jamf Connect Login
Jamf Connect Configuration
Create a Jamf Connect Login configuration profile:
Open Jamf Connect Configuration.
Select your IdP from the Identity Provider pop-up menu and complete the required fields.
(Optional) Click Advanced Setup to configure additional settings and test your configuration. For more information, see Jamf Connect Configuration.
Click Save to generate a configuration profile for Jamf Connect Login.
Upload your Jamf Connect configuration profile file to your MDM solution. If using Jamf Pro, use the "Custom Settings" payload.
For more information about custom configuration profiles, see the Deploying Custom Configuration Profiles using Jamf Pro Knowledge Base article.
Upload the provided license key configuration profile to your MDM solution.
Note: You can use the same license key for all Jamf Connect apps.
Scope the uploaded proﬁle from step 4 to the same computers targeted in step 3.
(Okta only) Enable Okta authentication by renaming the Jamf Connect Login installer package to include "Okta" in its name.
Upload the PKG ﬁles for Jamf Connect Login to your MDM solution.
Create a policy to deploy packages from step 6 and scope the policy to targeted computers.
Default Jamf Connect Login Mechanism
The XML below is the default loginwindow mechanism that the authchanger tool installs. All mechanisms installed with Jamf Connect Login are prefixed with "JamfConnectLogin".
Note: You can list the mechanisms in any order to accommodate your workflow.
The only built-in macOS mechanism removed is loginwindow:login, which displays the standard macOS login window.
You can view logs from Jamf Connect Login with the Console application or using the log command in Terminal. When capturing logs, you can filter on all logs from the Security Agent process, which runs all of the Jamf Connect Login mechanisms. Alternatively, you can filter the com.jamf.connect.login subsystem. The most recent login on the computer is stored in the following location: /private/tmp/jamf_login.log
To debug the logging process, use secure shell (SSH) to access the computer and execute following command:
log stream --predicate 'subsystem == "com.jamf.connect.login"' --debug
Note: Remote Login must be enabled on the computer to use SSH.
To stop logging, press control-C.
You can also execute the log show command to view logs after the user login process completes:
log show --predicate 'subsystem == "com.jamf.connect"' --debug
For more information see the Collecting Logs in Jamf Connect Login Knowledge Base article.
For related information see the following sections of this guide:
Learn how to use the authchanger tool to modify the authentication database on macOS.
Jamf Connect Configuration
Learn how to use the Jamf Connect Configuration app to create and test configuration profiles.
Configuring Jamf Connect Login
Learn about preference keys you can use to customize Jamf Connect Login.
For related information about customizing the Jamf Connect Login package, see the Customizing the Jamf Connect Login Package with Composer Knowledge Base article.