Login Window Preferences

DenyLocal

Require Network Authentication

Determines if users can bypass network authentication and use local account credentials.

When set to true, the Local Login button is not available, and the user must use network authentication to log in.

If set to false, the Local Login button is available, and users can choose to authenticate locally.

This setting can also be used to ensure network authentication on FileVault-enabled computers is not skipped on startup. For more information, see Disabling Automatic FileVault Login.

<key>DenyLocal</key>
<false/>

DenyLocalExcluded

Users with local authentication privileges

Specifies which users can still locally authenticate if DenyLocalis set to true

<key>DenyLocalExcluded</key>
<array>
<string>user-one</string>
<string>user-two</string>
<string>user-three</string>
<string>user-four</string>
</array>

LocalFallback

Allow Local Fallback

This key is used with DenyLocal to force authentication to the IdP first, but then fall back to local authentication if a network connection is unavailable.

<key>LocalFallback</key>
<false/>

Use Local Authentication by Default

When set to true, Jamf Connect will use local authentication by default rather than network authentication, which ensures users can always log in without a network connection.

<key>OIDCDefaultLocal</key>
<false/>

CreateAdminUser

Create Admin Users

Create all users as local administrators.

<key>CreateAdminUser</key>
<false/>

OIDCAdminAttribute

Admin Attribute

Specifies which attribute stored in an ID token is used to determine if a standard or administrator local account should be created for a user. By default, Jamf Connect will use the "groups" attribute to find any values specified in the Admin Roles (OIDCAdmin) setting.

<key>OIDCAdminAttribute</key>
<string>groups</string>

OIDCAdmin

Admin Roles

Specifies which user roles (or groups) configured in your IdP become local administrators during account creation. You can specify one role or more roles as an array of strings. Jamf Connect looks for these values in the "groups" attribute of the ID token by default unless the Admin Attribute (OIDCAdminAttribute) setting is configured.

<key>OIDCAdmin</key>
<array>
<string>role-one</string>
<string>role-two</string>
<string>role-three</string>
<string>role-four</string>
</array> 

OIDCIgnoreAdmin

Ignore Roles

When set to true, Jamf Connect Login will ignore any roles that exist in your IdP. This key ensures local user accounts maintain their current status as either an administrator or standard account.

When set to false or unspecified, Jamf Connect Login will read the OIDCAdmin key for configured roles and will change a local user account status based on any roles in your IdP.

<key>OIDCIgnoreAdmin</key>
<false/>

OIDCAccessClientID

Access Client ID

OIDC application to use for users that are allowed to create an account or log in to computers.

<key>OIDCAccessClientID</key>
<string>0oad0gmia54gn3y8923h1</string>

OIDCAdminClientID

Admin Client ID

OIDC application to use for users who are created as local administrators during account creation.

<key>OIDCAdminClientID</key>
<string>0oa0gwese54gn3y9O0h4</string>

OIDCSecondaryLoginClientID

Secondary Login Client ID

OIDC application to use for users that are allowed to create additional users on computers after the first account is created.

<key>OIDCSecondaryLoginClientID</key>
<string>0oa0grdsrhdsre54gn3y9O0h4</string>

OIDCRedirectURI

Redirect URI

The redirect URI used by your Jamf Connect app in your Okta.

https://127.0.0.1/jamfconnect is recommended by default, but any URI value may be used as long as the configured value in Okta matches the value in your Jamf Connect login configuration profile.

<key>OIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

MessageOTPEntry

One-time Password Message

(Okta only) Text displayed when a user must enter a one time password (OTP) as a multi-factor authentication (MFA) method.

<key>MessageOTPEntry</key>
<string>Enter your verification code.</string>

MFARename

MFA Option Names

<key>MFARename</key>

   <dict>

	<key>push</key>
	
<string>Okta Verify app: PushNotification</string>
	
<key>question</key>

	<string>Okta Security Questions</string>

	<key>web</key>
<string>Duo Mobile app</string>
<key>sms</key>

	<string>Okta SMS: Verification Code</string>

	<key>google:token:software:totp</key>

	<string>Google Authenticator app: Verification Code</string>

	<key>okta:token:software:totp</key>

	<string>Okta Verifiy app: Verification Code</string>

	<key>token:hardware</key>

	<string>USB Security Key</string>

   </dict>

MFAExcluded

Hidden MFA Options

<key>MFAExcluded</key>

   <array>

	<string>push</string>

	<string>question</string>

	<string>okta:token:software:totp</string>
	<string>google:token:software:totp</string>	
	<string>token:hardware</string>

	<string>webauthn</string>
	<string>web</string>
   </array>

OIDCAuthServer

Custom Okta Authorization Server

(Okta Only) Specifies a custom authorization server in your Okta tenant, which can be used to send custom scopes and claims in a user's ID token (stored via the OIDCIDTokenPath key) during local account creation.

To set this value, use the custom authorization server ID, which can be found as a string at the end of your custom authorization server's issuer URI. In the issuer URI below abc9o8wzkhckw9TLa0h7z is the authorization server ID.

<key>OIDCAuthServer</key>
<string>abc8o8wzjhckw9TLa0t8q</string>

For more information about creating a custom authorization server, see the Okta Authorization Server documentation from the Okta Developer website.

OIDCIgnoreCookies

Ignore Cookies

Ignores any cookies stored by the loginwindow application

<key>OIDCIgnoreCookies</key>
<false/>

OIDCScopes

OpenID Connect Scopes

Specifies custom scopes, which return additional claims in a user's ID token during authorization. Standard scopes include openid, profile, and offline_access. If you include multiple scopes, add a "+" to separate them.

<key>OIDCScopes</key>
<string>openid+profile</string>

Full Name

Specifies different attribute claims for full name, such as firstName and lastName or other custom value(s) unique to your environment. This preference overrides the default attributes used to set the full name for an account: name, family_name/given_name, and first/last.

<key>OIDCFullName</key> 
<string>firstName+lastName</string>

OIDCShortName

Short Name

Specifies which attribute claim from a user's ID token to use as the local macOS account name (also known as the short name). The user's network unique name (UPN prefix) is added as an alias to the user's local account.

<key>OIDCShortName</key>
<string>given_name</string>

OIDCROPGShortName

ROPG Short Name

Specifies which claim from an ID token to use as the username during the ROPG authentication (password verification) flow.

This setting is only used in complex IdP environments where the the IdP does not respect the claims used by Jamf Connect to define the username (e.g., unique_name, preferred_username, email, and sub) during the ROPG workflow.

<key>OIDCROPGShortName</key>
<string>given_name</string> 

OIDCIDTokenPath

Formatted ID Token Path

Specifies the file path that can be used to store a user's formatted ID token.

<key>OIDCIDTokenPath</key>
<string>/tmp/token</string>

OIDCIDTokenPathRaw

Raw ID Token Path

Specifies the file path that can be used to store a user's raw ID token.

<key>OIDCIDTokenPathRaw</key>
<string>/tmp/token-raw</string>

UseUserInfo

(PingFederate only) When set to true, allows Jamf Connect to request additional claims from a PingFederate user token. This setting should only be used if your are issuing an internally managed reference token from PingFederate.

For more information about managing PingFederate, see the OAuth Configuration section the PingFederate Administrator's Manual.

<key>UseUserInfo</key>
<false/>

EnableFDE

Enable FileVault

If set to true, FileVault will be enabled for the first user that logs in to a computer.

<key>EnableFDE</key>
<false/>

EnableFDERecoveryKey

Save FileVault Recovery Key

If set to true, Jamf Connect will store the personal recovery key (PRK) in /var/db/NoMADFDE unless otherwise specified.

<key>EnableFDERecoveryKey</key>
<false/>

EnableFDERecoveryKeyPath

Set Recovery Key Filepath

Specifies a custom file path for the PRK rather than using /var/db/NoMADFDE by default.

<key>EnableFDERecoveryKeyPath</key>
<string>/usr/local/filevault</string>

LAPSUser

LAPS User

An existing local administrator account that Jamf Connect can change the password to the personal recovery key.

This setting is only used by Jamf Connect to help enable FileVault for standard accounts on macOS 10.15.x. This setting should not be used on computers with macOS 11.0.1 or later.

<key>LAPSUser</key>
<string>AdminUser</string>

EULAFilePath

Acceptable Use Policy Web Address or File Path

Specifies the web address or file path that contains your acceptable use policy document that users must agree to before logging in.

Supported formats include: URL web address or the path of a locally stored PDF, TXT, RTF or RTFD file.

<key>EULAFilePath</key>
<string>/usr/local/shared/AcceptableUsePolicyFile.txt</string>

EULAPath

Audit File Path

Specifies the file path to a directory where the user's acceptance record of the acceptable use policy is stored.

This file path must have permissions that allow the _SecurityAgent write access. /Users/Shared/ is recommended.

<key>EULAPath</key>
<string>/usr/local/shared/AcceptableUsePolicy.txt</string>

EULAText

Acceptable Use Policy Text

<key>EULAText</key>
<string>Example body text.***New line of example body text.</string>

EULATitle

Acceptable Use Policy Title

Title of the acceptable use policy

<key>EULATitle</key>
<string>Terms & Conditions</string>

EULASubTitle

Acceptable Use Policy Subtitle

Subtitle of the acceptable use policy

<key>EULASubTitle</key
<string>Accept these terms and conditions to start using your Mac.</string>

ScriptArgs

Script Arguments

The arguments used with a specified script run by the RunScript mechanism

<key>ScriptArgs</key>
<array>
<string>-v</string>
<string>-user</string>
</array>

ScriptPath

Script Path

Specifies the path to a script or other executable run by the RunScript mechanism. Only one script can be used with Jamf Connect Login at any time.

<key>ScriptPath</key>
<string>/usr/local/bin/loginScript</string>

NotifyLogStyle

Display Jamf Pro policy logs as status updates on the Notify screen

When the Jamf Connect notify screen is configured, display Jamf Pro's policy logs during Automated Device Enrollment (formerly DEP) as status updates to users.

To enable this setting, set this value to jamf.

<key>NotifyLogStyle</key>
<string>jamf</string>

UIDTool

Use a Custom UID Tool

Specifies a path to a UID tool that allows you to set a local user account's UID to a custom value during account creation. This can be used to match a local user account's UID with a user's LDAP UID attribute. Your UID tool must be an executable script.

Your UID tool must accept account short names and respond with the UID you want for the user account.

<key>UIDTool</key>
<string>/Users/Shared/UIDTool</string>

AuthUIOIDCProvider

Identity Provider (PAM)

Specifies the identity provider to use for authentication via the Pluggable Authentication Module (PAM)

<key>AuthUIOIDCProvider</key>
<string>insert-identity-provider</string>

AuthUIOIDCClientID

Client ID (PAM)

The client ID of the created Jamf Connect app in your identity provider used for authentication via PAM

<key>AuthUIOIDCClientID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

AuthUIOIDCRedirectURI

Redirect URI (PAM)

The redirect URI used by the created Jamf Connect app in your identity provider

<key>AuthUIOIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

AuthUIOIDCTenant

Tenant ID (PAM)

The tenant in your identity provider used for authentication via PAM

<key>AuthUIOIDCTenant</key>
<string>dev-123456</string>

AuthUIOIDCClientSecret

Client Secret (PAM)

The client secret of your Jamf Connect app in your IdP. This value is only known by Jamf Connect and your IdP.

<key>AuthUIOIDCClientSecret</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>