Configuration

Fixed an issue that prevented Jamf Connect Configuration from notifying users of unsupported preference keys if their level of indentation in the XML file was three or more levels deep.

Menu Bar App

• If you do not have MFA configured, you can now use the ShortNameAttribute preference key to specify a custom attribute included in an ID token for use as a Kerberos short name. This value is stored in the Jamf Connect state settings as the CustomShortName key-value.
  For more information, see Menu Bar App Preferences.

• [PI-08909] Fixed an issue that caused Jamf Connect to fail to sync and store passwords in Keychain if the password contained the pound symbol (£).

• [PI-009016] Fixed an issue that caused Jamf Connect to continue to prompt users for their short name at each login.

• [PI-009017] Fixed an issue that caused the menu bar app to not respect the Hide Password Expiration Menu Item (PasswordExpiration) preference.

• [PI-009018] Fixed an issue that caused Jamf Connect to display a blank web view when attempting to log in to the menu bar app if the network password was expired and MFA was not configured.

• [JC-2302] Fixed an issue that caused the menu bar app to display a nonresponsive item named "item" when the password expiration menu bar item was not configured to be hidden.

• [JC-2195] Fixed an issue that caused some elements of security prompts to be obscured when the language settings were set to a language other than English.

Configuration

You can now use the text editor in Jamf Connect Configuration to add and edit nonstandard preference keys. Configurations with nonstandard keys can also be imported without being modified.

Licensing

Fixed an issue that prevented license data from being respected as a base64 encoded string that is configured with the License File (LicenseFile) preference key.

Login Window

• [PI-008704] Fixed an issue that prevented local user accounts created via Okta from respecting user role changes configured with OIDC apps in Okta.

• [PI-008935] [JC-2017] Fixed an issue that prevented custom messages displayed with the Login Window Message (LoginWindowMessage) setting from hiding the last word of the message.

• Fixed an issue that caused the login window to cache usernames in the identity provider (IdP) web view on computers with macOS 11.

• Fixed an issue that caused the username text to turn black when selected after an unsuccessful Okta authentication attempt on computers with macOS 11.

Login Window

• [PI-008725] Fixed an issue that prevented password verification from succeeding and a custom short name from being added to the user's local account when the Short Name (OIDCShortName) setting was used.

• [JC-2175] Fixed an issue that caused loginwindow mechanisms to run twice after upgrading Jamf Connect to a new version, which sometimes caused the Acceptable Use Policy screen, when configured, to appear twice during user logins.

Menu Bar App

[PI-008974] Fixed an issue that sometimes caused Jamf Connect to fail to prompt users to update out of sync passwords if the password was changed in Okta.

Configuration

• [JC-2021] Fixed an issue that caused Jamf Connect Configuration to lose license file information when quit.

• [JC-2050] Fixed an issue that caused Jamf Connect Configuration to create a blank configuration when clicking Cancel on an unsupported keys alert.

Login Window

• [PI-007101] Fixed an issue that prevented Google ID users from being prompted to enroll in multifactor authentication (MFA) when required.

• [PI-008868] Fixed an issue that prevented the Use Local Authentication by Default (OIDCDefaultLocal) setting from being respected.

• [PI-008870] [JC-1956] Fixed an issue that caused the acceptable use policy screen, when configured, to incorrectly display.

• [PI-008874] Fixed an issue that prevented OneLogin users from creating accounts via Jamf Connect and Jamf Pro's Enrollment Customization settings.

• [PI-008861] Fixed an issue that caused to Login Window Message (LoginWindowMessage) to be unavailable in the Jamf Repository settings available in Jamf Pro's Application & Custom Settings payload.

• [PI-008899] Fixed an issue that caused the notify screen, when enabled, to expand to the full-screen width.

Menu Bar

• [PI-008593] Fixed an issue that caused the menu bar app to fail to redirect users to the Okta dashboard if the Auth Server (AuthServer) value in the configuration is spelled with any capital letters.

• [PI-008869] Fixed an issue that caused the menu bar app to incorrectly display a license validation error on computers with a valid Jamf Connect license.

• [JC-1939] Fixed an issue that caused the menu bar app to always open Jamf Self Service if it is installed on the computer, even when the Self Service Path (SoftwarePath) preference is configured to open a different software.

• [JC-1987] Fixed an issue that caused the Home or Home Directory menu bar item to appear even when the UserHomeDirectory value did not exist in a user's state settings or when a Kerberos integration was not configured.

• [JC-2080] Fixed an issue that prevented the value of the ShortName key from being used for Kerberos authentication.

Configuration

• [JC-1922] Fixed an issue that caused Jamf Connect Configuration to fail to clear formatting on text pasted into the code editing field.

• [JC-2053] Fixed an issue that caused the Jamf Connect Configuration UI to be missing the User Help, Keychain, Scripting, and Certificates settings sections.

New App Icon

The Jamf Connect app has a new icon. Look for the following icon in the Applications folder when Jamf Connect is installed on computers:

New Menu Bar Sign-In Preference for Okta

Users can now determine whether the Okta dashboard is opened in their selected browser after sign-in by selecting the checkbox next to the Browser pop-up menu. This setting is enabled by default and can be managed with the LaunchBrowser preference key (boolean) in the WebBrowser dictionary.

Step Indicators

The top of the login window now includes step indicators to help users through the Jamf Connect login process. Depending on the workflow, users will see the following:

• Authenticate—Displays when users must authenticate with their cloud identity provider (IdP) and complete a multifactor authentication (MFA) challenge through their IdP, if configured.

• Connect—Displays when the Connect existing local accounts to a network account (Migrate) settings is enabled. The user must 1) enter the password of an already existing local account that has a username that matches an account in the IdP, 2) choose an existing local account to connect to the IdP, or 3) create a new account based on the cloud IdP.

• Verify—Asks the user to re-enter their network password, which serves as both an additional security layer and verifies that the user's local and IdP passwords match. If the network password does not match the local password, the user will be prompted to sync passwords.

Other Changes and Enhancements

• Network Selection—The "Allow Network Selection" button has been replaced with a WiFi icon in the upper-right corner of the login window

• Local Login—The "Local Auth" button is now named "Local Login" and appears along the bottom of the login window.

• Error Messaging—Some error messages have been improved to help users troubleshoot configuration issues.

• Custom Login Window Message—You can now add a custom message to the login window by configuring the LoginWindowMessage preference key.

For more information about the login window user experience, see End User Experience and Workflows.

XML Editor

You can now use an XML editor mode to preview the configuration profile in XML and make manual changes to your configuration profile.

To view and edit your configuration profile in XML, click the </> icon.

New App Icon

Jamf Connect Configuration now uses the following icon in the Applications folder and Dock:

authchanger Improvements

The commands arguments executed by the authchanger tool can now be read from a configuration profile. If used, the configuration profile must be written to com.jamf.connect.authchanger and contains the Arguments key, which is an array of strings of supported authchanger arguments. Arguments are read in the order in which the strings are configured, similar to how they are ordered in the command-line.

The following example enables Jamf Connect authentication:

<key>Arguments</key>
<array>
 <string>-reset<key>
 <string>-jamfconnect</string>
</array>

The Jamf Connect installer does not add any arguments to authchanger by default. To enable the login window, you use one of the following methods to pass authchanger arguments:

1. Commands executed via the command-line. Consider the following scenarios:

   • If a command is executed with arguments, any preferences found in a configuration profile will be ignored.

   • If a command is executed without arguments, Jamf Connect will look for preferences in a configuration profile.

2. Preferences found in a configuration profile written to com.jamf.connect.authchanger

3. The Identity Provider (OIDCProvider) or Auth Server (AuthServer) preferences written to the com.jamf.connect.login. These pass the -JamfConnect argument to automatically enable OpenID Connect or Okta authentication.

4. If no arguments or preferences are found, the default loginwindow mechanisms will remain unchanged.

For more information about the authchanger tool, see authchanger.

Licensing Updates

The Jamf Connect menu bar app will now check both the com.jamf.connect and com.jamf.connect.login preference domains for a valid license. This ensures that you only have to deploy the license file in a single configuration profile, if you are using both the login window and the menu bar app for your organization.

Menu Bar App Launch Agent

A launch agent for the Jamf Connect menu bar is included as a separate installer package in the Jamf Connect DMG. When installed on computers, the launch agent will ensure that Jamf Connect remains open.

Jamf Connect Sync Preference Key Changes

Jamf Connect Verify Preference Key Changes