Login Window Preferences

This reference contains all available preferences for the Jamf Connect login window. Configure preferences in either Jamf Connect Configuration or in a Jamf Pro configuration profile created at Configuration Profiles > Application & Custom Settings. For more information, see Configuration.

Login Window Authentication Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to allow Jamf Connect to complete authentication between your IdP and local accounts at the login window. Required settings vary by IdP.

Key

Description

OIDCProvider

Identity Provider

Specifies your cloud identity provider. The following values are supported:

  • Azure
  • IBMCI
  • GoogleID
  • OneLogin
  • Okta
  • PingFederate
  • Custom
<key>OIDCProvider</key>
<string>Azure</string>

AuthServer

Auth Server

(Okta Only) Specifies your organization's Okta domain URL.

<key>AuthServer</key>
<string>yourcompany.okta.com</string>

OIDCClientID

Client ID

Specifies the client ID of the Jamf Connect app in your IdP used to authenticate the user.

<key>OIDCClientID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

OIDCRedirectURI

Redirect URI

Specifies the redirect URI used by your Jamf Connect app in your IdP.

https://127.0.0.1/jamfconnect is recommended by default, but any URI value may be used as long as the configured value in your IdP matches the value in your Jamf Connect login configuration profile.

<key>OIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

OIDCClientSecret

Client Secret

Specifies the client secret used by Jamf Connect Login and your IdP.

<key>OIDCClientSecret</key>
<string>insert-client-secret-here</string>

OIDCTenant

Tenant ID

Specifies the Tenant ID for your organization that's used for authentication.

<key>OIDCTenant</key>
<string>c27d1b33-59b3-4ab2-a5c9-23jf0093</string>

OIDCDiscoveryURL

Discovery URL

Specifies your IdP's OpenID metadata document that stores OpenID configuration information. This value appears in the following format: "https://domain.url.com/.well-known/openid-configuration"

Note:

This key is required if your Identity Provider (OIDCProvider) is set to Custom or PingFederate

<key>OIDCDiscoveryURL</key>
<string>https://identity-provider-example-address.com/.well-known/openid-configuration</string>
OIDCUsePassthroughAuth

Use Passthrough Authentication

Securely sends a user's network password entered in the sign-in web view to Jamf Connect for local authentication. This allows Jamf Connect to complete network and local authentication without prompting users to re-enter a password. During local account creation, this ensures that the network password is automatically used as the local password. This setting is disabled ( set to false) by default.

If you are using Azure AD, the OIDCNewPassword setting must be disabled (set to false).

<key>OIDCUsePassthroughAuth</key>
<false/>
For more information, see Passthrough Authentication with Jamf Connect.

LicenseFile

License File

Specifies the contents of a Jamf Connect license file encoded in Base64 data format. License files are available from Jamf Account.

<key>LicenseFile</key>
<string>encoded-license-content</string>

Initial Password Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to determine how Jamf Connect creates a local password during account creation and if a user's local and network passwords should be verified during each login to make sure they are in sync.

Key

Description

OIDCNewPassword

 

Create a Separate Local Password

If enabled (set to true), this setting prompts users to create a new password for their new local account.

If disabled (set to false), this key prompts users to re-enter their network password, which also becomes the local account password. This ensures a user's network and local password are synced during user creation.

Note:

This setting is enabled (set to true) by default.

<key>OIDCNewPassword</key>
<true/>

OIDCROPGID

Client ID (Password Verification)

Specifies the Client ID of the registered app in your IdP used for authenticating the user's password via a resource owner password grant (ROPG) workflow. This value usually matches the OIDCClientID setting.

<key>OIDCROPGID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

CreateJamfConnectPassword

Create Jamf Connect Keychain

Automatically create a keychain item for Jamf Connect during the account creation process. This allows the Jamf Connect menu bar app to populate user credentials in the sign-in window when the app is first opened.

Note:

To use this setting, the Create a Separate Local Password (OIDCNewPassword) setting must be disabled (set to false).

<key>CreateJamfConnectPassword</key>
<true/>

ROPGSuccessCodes

Password Verification Success Codes

Specifies an array of strings that contain error codes from your IdP during an ROPG password verification, which should be interpreted as successful by Jamf Connect.

For possible error codes that may need to be configured in your environment, see Azure AD Authentication and authorization error codes documentation from Microsoft.

If you use OneLogin and multifactor authentication in your environment, set this setting to MFA.

<key>ROPGSuccessCodes</key>
<array>
<string>AADSTS50012</string>
<string>AADSTS50131</string>
</array>

Local and Network Authentication Management Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to determine local and network authentication restrictions.

Key

Description

DenyLocal

Require Network Authentication

Determines if users can bypass network authentication and use local account credentials.

When enabled (set to true), the Local Login button is not available, and the user must use network authentication to log in.

If disabled (set to false), the Local Login button is available, and users can choose to authenticate locally.

You can also use this setting to ensure that network authentication on FileVault-enabled computers is not skipped upon startup. For more information, see Disabling Automatic FileVault Login.

<key>DenyLocal</key>
<false/>

DenyLocalExcluded

Users with local authentication privileges

Specifies which users can still locally authenticate if the DenyLocal setting is enabled (set to true).

<key>DenyLocalExcluded</key>
<array>
<string>user-one</string>
<string>user-two</string>
<string>user-three</string>
<string>user-four</string>
</array>

LocalFallback

Allow Local Fallback

This key is used with DenyLocal to force authentication to the IdP first, but then fall back to local authentication if a network connection is unavailable.

<key>LocalFallback</key>
<false/>
OIDCDefaultLocal

Use Local Authentication by Default

When this setting is enabled (set to true), Jamf Connect uses local authentication by default rather than network authentication, which ensures users can always log in without a network connection.

<key>OIDCDefaultLocal</key>
<false/>

Account Migration Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to configure account connections between existing local accounts and network accounts.

Key

Description

Migrate

Connect existing local accounts to a network account

Allows existing local accounts to be connected to a network account.

This setting is typically used when you want a user's existing local account to have the same username and password as the user's network account.

When enabled (set to true), users must log in with their IdP, then Jamf Connect looks for a matching local account.

Note:
  • To use this setting, the Require Network Authentication (DenyLocal) must be set to true. For more information, see Network and Local Authentication Restrictions.
  • For every successful network authentication, the user's record will be updated with the "NetworkSignIn" attribute. If a user only uses local authentication, this attribute will not be updated.
<key>Migrate</key>
<false/>

MigrateUsersHide

Local accounts prohibited from network account connection

Specifies a list of usernames of local accounts that are excluded from the migration process. These accounts will not be available to users during the "Connect" step of the login process.

<key>MigrateUsersHide</key>
<array>
<string>admin</string>
<string>ladmin</string>
</array>
CreateNewUserHide

Hide "Create New User" option at migration

Enables hiding the Create New User option from users during account migration. With this setting enabled (set to true), users are unable to disrupt account migration by creating a new account. This setting is not enabled (set to null) by default.

<key>CreateNewUserHide</key>
<true/>

DemobilizeUsers

Demobilize Accounts

Determines if any existing Active Directory mobile accounts are demobilized. Demobilization results in the following:

  • Mobile accounts become local accounts

  • Active Directory is removed as a network connection authority

  • Accounts lose MDM-capable status

Jamf recommends transitioning away from user-level configuration profiles before demobilizing. For more information about MDM enrollment methods, see MDM-Enabled Local User Accounts in the Jamf Pro Documentation.

Once demobilized, you can unbind computers from Active Directory. For demobilization instructions, see the Demobilizing and Unbinding Mobile Accounts with Jamf Connect and Jamf Pro technical article.

Important:

If you unbind from Active Directory before demobilization, demobilization may fail if a user's Active Directory password and IdP password do not match and Jamf Connect is configured to sync the passwords during account creation. Make sure you demobilize accounts before unbinding from Active Directory and that the Active Directory domain is reachable during account creation with Jamf Connect.

<key>DemobilizeUsers</key>
<false/>

Login Window Custom Branding Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to customize the Jamf Connect login window for your organization

Key

Description

BackgroundImage

Background Image

Specifies a path to a locally stored image to use as a background for the login window. This image file must be stored in a location that can be read from the login window.

If this setting does not contain an image file path, the default background is the macOS wallpaper.

<key>BackgroundImage</key>
<string>/usr/local/shared/background.jpg</string>

LoginLogo

Login Logo

Specifies a path to a locally stored image to use as a logo during password validation or local password creation.

Note:
  • A 250 x 250 pixel image is recommended.
  • Do not include a backslash "\" in your file path.
  • The image file and its file path must be assigned a permissions set that can be read from the login window, such as 444.
<key>LoginLogo</key>
<string>/usr/local/images/logo.png</string>

LoginWindowMessage

Login Window Message

Specifies a custom message to display in the lower-center of the login window.

Note:

This text is displayed in a single line. Line breaks are not supported, and messages that are too long may not display as expected.

<key>LoginWindowMessage</key>
<string>Log in with your company username and password.</string>

Login Window User Help Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to allow users to access resources with a help button, join a Wi-Fi network in the login window, and use the power control buttons.

Key

Description

AllowNetworkSelection

Allow Network Selection

When this setting is enbaled (set to true), users can configure and confirm their network connection preferences from the login window. To access this feature, users can click the Wi-Fi icon in the top-right of the login window.

Note:

To ensure the security of computers, users cannot connect to networks via captive portal at the Jamf Connect login window.

<key>AllowNetworkSelection</key>
<false/>

HelpURL

Help URL

Specifies a URL to display at the login window that directs a user to a resource for onboarding or enrollment help.

<key>HelpURL</key>
<string>yourcompany.help.com</string>

LocalHelpFile

Backup Help File

Specifies a path to a local file, such as a network troubleshooting or onboarding guide, that users can access by clicking the Help icon in the Jamf Connect login window.

This file is only displayed if the computer cannot connect to the internet or access the URL specified with the HelpURL setting.

Note:

Supported file types include PDF and HTML.

<key>LocalHelpFile</key>
<string>/usr/local/shared/JamfConnectHelp.pdf</string>

OIDCHideShutdown

Hide Shut Down Button

Hides the Shut down button from users at the login window.

<key>OIDCHideShutdown</key>
<false/>

OIDCHideRestart

Hide Restart Button

Hides the Restart button from users at the login window.

<key>OIDCHideRestart</key>
<false/>

Azure AD Hybrid ID Settings

  • Domaincom.jamf.connect.login
  • Description

    Used configure authentication and password syncing for Azure AD hybrid identity environments.

Key

Description

ROPGProvider

Identity Provider (Hybrid ID)

Specifies where Jamf Connect should attempt to sync passwords. The following values are supported:

  • Custom
  • Azure_v2
 
<key>ROPGProvider</key>

<string>Azure_v2</string>

ROPGTenant

Tenant ID (Hybrid ID)

Specifies the tenant ID in your organization to use for password verification.

<key>ROPGTenant</key>

<string>15e7196d-8bd5-4034-ae01-7bda4ad0c91e</string>

ROPGDiscoveryURL

Discovery URL (Hybrid ID)

Specifies your OpenID Connect discovery endpoint. If using AD FS, this value is your AD FS domain combined with the following: "/adfs/.well-known/openid-configuration"

Note:

This key is required if you set the ROPGProvider key to "Custom".

<key>ROPGDiscoveryURL</key>
<string>https://adfs.jamfconnect.com/adfs/.well-known/openid-configuration</string>

 

ROPGRedirectURI

Redirect URI (Hybrid ID)

Specifies the redirect URI used by the created application in AD FS or Azure AD.

https://127.0.0.1/jamfconnect is recommended by default, but any valid URI value may be used as long as the configured value in Azure AD or AD FS matches the value in your Jamf Connect Login configuration profile.

<key>ROPGRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

ROPGClientSecret

Client Secret (Hybrid ID)

Specifies the client secret of your Jamf Connect application. Consider the following scenarios when configuring client secrets:

  • If you are using the same client secret for both ROPG and the authorization grant with Azure AD, do not set this setting. Jamf Connect Login will use the secret set with the OIDCClientSecret setting for both authentication and password verification.
  • If you are not using a client secret for ROPG authentication, set this value to NONE.
  • If using a different client secret for each authentication process, set both the OIDCClientSecret and ROPGClientSecret settings to their respective values.
<key>ROPGClientSecret</key>

<string>your-client-secret</string>

Universal User Role Settings

  • Domaincom.jamf.connect.login
  • Description

    User role setting that can be used by any cloud IdP.

Key

Description

CreateAdminUser

Create Admin Users

Creates all users as local administrators.

Note:

This key only creates new users as local administrators and does not enforce local account status after account creation. If user roles are configured in your IdP and specified with the Admin Roles (OIDCAdmin) setting, local user accounts may change during the next log in.

<key>CreateAdminUser</key>
<false/>

OpenID Connect User Role Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to configure user roles from ID token attributes receive from an OpenID Connect authentication

Key

Description

OIDCAdminAttribute

Admin Attribute

Specifies which attribute stored in an ID token is used to determine if a standard or administrator local account should be created for a user. By default, Jamf Connect uses the groups attribute to find any values specified in the Admin Roles (OIDCAdmin) setting.

Note:
  • If using Azure AD, set this value to roles.
  • If using Google Identity, user roles cannot be defined using an ID token.
<key>OIDCAdminAttribute</key>
<string>groups</string>

OIDCAdmin

Admin Roles

Specifies which user roles (or groups) configured in your IdP become local administrators during account creation. You can specify one role or more roles as an array of strings. Jamf Connect looks for these values in the "groups" attribute of the ID token by default unless the Admin Attribute (OIDCAdminAttribute) setting is configured.

Note:

If using Google Identity, user roles cannot be defined using an ID token.

<key>OIDCAdmin</key>
<array>
<string>role-one</string>
<string>role-two</string>
<string>role-three</string>
<string>role-four</string>
</array> 

OIDCIgnoreAdmin

Ignore Roles

When enabled (set to true), Jamf Connect Login ignores any roles that exist in your IdP. This setting ensures local user accounts maintain their current status as either an administrator or standard account.

When disabled (set to false) or unspecified, Jamf Connect Login reads the OIDCAdmin setting for configured roles and will change a local user account status based on any roles in your IdP.

<key>OIDCIgnoreAdmin</key>
<false/>

Okta User Role Settings

  • Domain

    com.jamf.connect.login

  • Description

    (Okta Only) Used to configure user roles for new local accounts.

Key

Description

OIDCAccessClientID

Access Client ID

Specifies the OIDC application to use for users that are allowed to create an account or log in to computers.

Note:

All users, including administrators, must be added to this app in your Okta admin console to ensure access to Jamf Connect.

<key>OIDCAccessClientID</key>
<string>0oad0gmia54gn3y8923h1</string>

 

OIDCAdminClientID

Admin Client ID

Specifies the OIDC application to use for users who are created as local administrators during account creation.

Note:

Only administrators should be added to this app in your Okta admin console.

<key>OIDCAdminClientID</key>
<string>0oa0gwese54gn3y9O0h4</string>

 

OIDCSecondaryLoginClientID

Secondary Login Client ID

Specifies the OIDC application to use for users that are allowed to create additional users on computers after the first account is created.

<key>OIDCSecondaryLoginClientID</key>
<string>0oa0grdsrhdsre54gn3y9O0h4</string>

OIDCRedirectURI

Redirect URI

Specifies the redirect URI used by your Jamf Connect app in your Okta.

https://127.0.0.1/jamfconnect is recommended by default, but any URI value may be used as long as the configured value in Okta matches the value in your Jamf Connect login configuration profile.

<key>OIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

Okta Multifactor Authentication Settings

  • Domain

    com.jamf.connect.login

  • Description

    (Okta Only) Used to customize MFA options and text.

Key

Description

MessageOTPEntry

One-time Password Message

(Okta only) Specifies text displayed when a user must enter a one time password (OTP) as a multi-factor authentication (MFA) method.

<key>MessageOTPEntry</key>
<string>Enter your verification code.</string>

MFARename

MFA Option Names

(Okta only) Specifies custom names for each MFA option used with Okta authentication in your organization. For more information, about the types of MFA options you can configure with Jamf Connect and Okta, see Multifactor Authentication.
<key>MFARename</key>

   <dict>

	<key>push</key>
	
<string>Okta Verify app: PushNotification</string>
	
<key>question</key>

	<string>Okta Security Questions</string>

	<key>web</key>

	<string>Duo Mobile app</string>

	<key>sms</key>

	<string>Okta SMS: Verification Code</string>

	<key>google:token:software:totp</key>

	<string>Google Authenticator app: Verification Code</string>

	<key>okta:token:software:totp</key>

	<string>Okta Verify app: Verification Code</string>

	<key>token:hardware</key>

	<string>USB Security Key</string>

   </dict>

MFAExcluded

Hidden MFA Options

(Okta only) Specifies a list of MFA options that you do not want to display to users.
<key>MFAExcluded</key>

   <array>

	<string>push</string>

	<string>question</string>

	<string>okta:token:software:totp</string>
	<string>google:token:software:totp</string>	
	<string>token:hardware</string>

	<string>webauthn</string>
	<string>web</string>
   </array>

Advanced Login Authentication Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to configure advanced authentication settings and use custom claims in an ID token.

Key

Description

OIDCAuthServer

Custom Okta Authorization Server

(Okta Only) Specifies a custom authorization server in your Okta tenant, which can be used to send custom scopes and claims in a user's ID token (stored via the OIDCIDTokenPath setting) during local account creation.

To set this value, use the custom authorization server ID, which can be found as a string at the end of your custom authorization server's issuer URI. In the issuer URI below abc9o8wzkhckw9TLa0h7z is the authorization server ID.

Example: https://your-custom-auth-server.okta.com/oauth2/abc8o8wzjhckw
To use this setting, you must create an Okta app integration to define user roles for the (OIDCAccessClientID) setting.
Note:

This setting should only be used if your Okta tenant has a separate authorization server that manages OpenID Connect apps and ID token attributes. If this setting is configured with the same value as your primary tenant used with the Auth Server (AuthServer) setting, authentication with Okta may cause unexpected errors.

<key>OIDCAuthServer</key>
<string>abc8o8wzjhckw9TLa0t8q</string>

For more information about creating a custom authorization server, see the Okta Authorization Server documentation from the Okta Developer website.

OIDCIgnoreCookies

Ignore Cookies

Ignores any cookies stored by the loginwindow application

<key>OIDCIgnoreCookies</key>
<false/>

OIDCScopes

OpenID Connect Scopes

Specifies custom scopes, which return additional claims in a user's ID token during authorization. Standard scopes include openid, profile, and offline_access. If you include multiple scopes, add a "+" to separate them.

<key>OIDCScopes</key>
<string>openid+profile</string>
OIDCFullName

Full Name

Specifies a single different claim for full name, such as firstName, lastName, or another custom value unique to your environment. This setting overrides the default attributes used to set the full name for an account: name, family_name/given_name, and first/last.

<key>OIDCFullName</key> 
<string>firstName+lastName</string>

OIDCShortName

Short Name

Specifies which claim from a user's ID token to use as the local macOS account name (short name). The user's network unique name (UPN prefix) is added as an alias to the user's local account.

Note:

If the claim you want to use is not in the standard ID token, you can receive additional claims in an ID token by specifying additional claims with the OIDCScopes preference key.

<key>OIDCShortName</key>
<string>given_name</string>

OIDCROPGShortName

ROPG Short Name

Specifies which claim from an ID token to use as the username during the ROPG authentication (password verification) flow.

Note:

If the claim you want to use is not in the standard ID token, you can receive additional claims in an ID token by specifying additional claims with the OIDCScopes preference key.

This setting is only used in complex IdP environments where the the IdP does not respect the claims used by Jamf Connect to define the username (e.g., unique_name, preferred_username, email, and sub) during the ROPG workflow.

<key>OIDCROPGShortName</key>
<string>given_name</string> 

OIDCIDTokenPath

Formatted ID Token Path

Specifies the file path that can be used to store a user's formatted ID token.

Note:

This setting requires that the RunScript mechanism is enabled. For more information, see Adding a Login Script.

<key>OIDCIDTokenPath</key>
<string>/tmp/token</string>

OIDCIDTokenPathRaw

Raw ID Token Path

Specifies the file path that can be used to store a user's raw ID token.

Note:

This setting requires that the RunScript mechanism is enabled. For more information, see Adding a Login Script.

<key>OIDCIDTokenPathRaw</key>
<string>/tmp/token-raw</string>

UseUserInfo

(PingFederate only) When enabled (set to true), this setting allows Jamf Connect to request additional claims from a PingFederate user token. This setting should only be used if your are issuing an internally managed reference token from PingFederate.

For more information about managing PingFederate, see the OAuth Configuration section the PingFederate Administrator's Manual.

<key>UseUserInfo</key>
<false/>

FileVault Settings

  • Domain

    com.jamf.connect.login

  • Description

    Used to configure how FileVault is enabled with Jamf Connect.

Key

Description

EnableFDE

Enable FileVault

When enabled (set to true), FileVault is enabled for the first user that logs in to a computer.

<key>EnableFDE</key>
<false/>

EnableFDERecoveryKey

Save FileVault Recovery Key

When enabled (set to true), Jamf Connect will store the personal recovery key (PRK) in /var/db/NoMADFDE unless otherwise specified.

<key>EnableFDERecoveryKey</key>
<false/>

EnableFDERecoveryKeyPath

Set Recovery Key Filepath

Specifies a custom file path for the PRK rather than using /var/db/NoMADFDE by default.

<key>EnableFDERecoveryKeyPath</key>
<string>/usr/local/filevault</string>

LAPSUser

LAPS User

An existing local administrator account that Jamf Connect can change the password to the personal recovery key.

This setting is only used by Jamf Connect to help enable FileVault for standard accounts on macOS 10.15.x. This setting should not be used on computers with macOS 11.0.1 or later.

<key>LAPSUser</key>
<string>AdminUser</string>

Acceptable Use Policy Settings

  • Domain

    com.jamf.connect.login

  • Description

    Used to configure an acceptable use policy to display to users at the Jamf Connect login window

Key

Description

EULAFilePath

Acceptable Use Policy Web Address or File Path

Specifies the web address or file path that contains your acceptable use policy document that users must agree to before logging in.

Supported formats include: URL web address or the path of a locally stored PDF, TXT, RTF or RTFD file.

<key>EULAFilePath</key>
<string>/usr/local/shared/AcceptableUsePolicyFile.txt</string>

EULAPath

Audit File Path

Specifies the file path to a directory where the user's acceptance record of the acceptable use policy is stored.

This file path must have permissions that allow the _SecurityAgent write access. /Users/Shared/ is recommended.

<key>EULAPath</key>
<string>/usr/local/shared/AcceptableUsePolicy.txt</string>

EULAText

Acceptable Use Policy Text

Specifies the body text of the acceptable use policy.
Note:

To format the body text, you can enter *** in this string value to start a new line.

<key>EULAText</key>
<string>Example body text.***New line of example body text.</string>

EULATitle

Acceptable Use Policy Title

Specfie the title of the acceptable use policy.

<key>EULATitle</key>
<string>Terms & Conditions</string>

EULASubTitle

Acceptable Use Policy Subtitle

Specifies the subtitle of the acceptable use policy.

<key>EULASubTitle</key
<string>Accept these terms and conditions to start using your Mac.</string>

Login Script Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to execute scripts during the login process.

    Note:

    The RunScript mechanism must be enabled before configuring script preferences.

Key

Description

ScriptArgs

Script Arguments

Specifies the arguments used with a specified script run by the RunScript mechanism.

Note:

The ScriptPath key must bey specified.

<key>ScriptArgs</key>
<array>
<string>-v</string>
<string>-user</string>
</array>

ScriptPath

Script Path

Specifies the path to a script or other executable run by the RunScript mechanism. Only one script can be used with Jamf Connect Login at any time.

<key>ScriptPath</key>
<string>/usr/local/bin/loginScript</string>

NotifyLogStyle

Displays Jamf Pro policy logs as status updates on the Notify screen.

When the Jamf Connect notify screen is configured, display Jamf Pro's policy logs during Automated Device Enrollment (formerly DEP) as status updates to users.

To enable this setting, set this value to jamf.

<key>NotifyLogStyle</key>
<string>jamf</string>

UIDTool

Use a Custom UID Tool

Specifies a path to a UID tool that allows you to set a local user account's UID to a custom value during account creation. This can be used to match a local user account's UID with a user's LDAP UID attribute. Your UID tool must be an executable script.

Your UID tool must accept account short names and respond with the UID you want for the user account.

<key>UIDTool</key>
<string>/Users/Shared/UIDTool</string>

Pluggable Authentication Module (PAM) Settings

  • Domaincom.jamf.connect.login
  • Description

    Used to enable PAM authentication on computers.

Key

Description

AuthUIOIDCProvider

Identity Provider (PAM)

Specifies the identity provider to use for authentication via PAM.

<key>AuthUIOIDCProvider</key>
<string>insert-identity-provider</string>

AuthUIOIDCClientID

Client ID (PAM)

Specifies the client ID of the created Jamf Connect app in your identity provider used for authentication via PAM.

<key>AuthUIOIDCClientID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

AuthUIOIDCRedirectURI

Redirect URI (PAM)

Specifies the redirect URI used by the created Jamf Connect app in your IdP.

<key>AuthUIOIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>

AuthUIOIDCTenant

Tenant ID (PAM)

Specifies the tenant in your IdP used for authentication via PAM.

Note:

If Okta is your IdP, this key is required.

<key>AuthUIOIDCTenant</key>
<string>dev-123456</string>

AuthUIOIDCClientSecret

Client Secret (PAM)

Specifies the client secret of your Jamf Connect app in your IdP. This value is only known by Jamf Connect and your IdP.

<key>AuthUIOIDCClientSecret</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>