Menu Bar App Preferences

This reference contains all available preferences for the Jamf Connect menu bar app.

Menu Bar Authentication Settings

  • Domaincom.jamf.connect
  • DictionaryIdPSettings
  • Description

    Used to allow Jamf Connect to complete authentication between your IdP and local accounts. Required settings vary by IdP.

Key

Description

Provider

Identity Provider

(Required) The name of your cloud identity Provider. The following values are supported:

  • Azure
  • IBMCI
  • Okta
  • OneLogin
  • PingFederate
  • Custom
<key>Provider</key>
<string>Azure</key>

OktaAuthServer

Okta Auth Server

(Required: Okta Only) Your organization's Okta domain. A preceding "https://" is optional.

<key>OktaAuthServer</key>
<string>your-company.okta.com</string>

ROPGID

Client ID

(Required: OpenID Connect only) The client ID of your Jamf Connect app in your IdP. This value allows Jamf Connect to complete a resource owner password grant (ROPG), which is the process that performs password verification.

<key>ROPGID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

DiscoveryURL

Discovery URL

Your IdP's OpenID Connect discovery endpoint. This value appears in the following format: https://domain.url.com/.well-known/openid-configuration

If using AD FS, this value is your AD FS domain combined with the following: /adfs/.well- known/openid-configuration\

Note:

This key is required if your Identity Provider (OIDCProvider) is set to Custom or PingFederate.

<key>DiscoveryURL</key>
<string>https://domain.url.com/.well-known/openid-configuration</string>

TenantID

Tenant ID

The Tenant ID for your organization used for authentication.

Note:

If IBM Security Verify is your IdP, this value is required and matches the tenant name used in your IBM URL. (e.g. https://companyname.ibmcloud.com)

<key>TenantID</key>
<string>companyname</string>

ChangePasswordURL

Change Password URL

A URL to a password change web page supported by your IdP

<key>ChangePasswordURL</key>
<string>https://idp.example.com/.well-known/change-password</string> 

ResetPasswordURL

Reset Password URL

A URL to a password reset web page supported by your IdP

<key>ResetPasswordURL</key>
<string>https://idp.example.com/.well-known/reset-password</string>

ClientSecret

Client Secret

The client secret of your Jamf Connect app in your IdP.

<key>ClientSecret</key>
<string>yourClientSecret</string>

SuccessCodes

Password Verification Success Codes

An array of strings that contain error codes from your IdP during an ROPG password verification, which should be interpreted as successful by Jamf Connect.

For possible error codes that may need to be configured in your environment, see the Azure AD Authentication and authorization error codes documentation from Microsoft.

If using OneLogin, set this key to "MFA", if multifactor authentication is used in your environment.

<key>SuccessCodes</key>
<array>
<string>AADSTS50012</string>
<string>AADSTS50131</string>
</array>

Menu Bar Sign-in Settings

  • Domaincom.jamf.connect
  • DictionarySignIn
  • Description

    Used to configure the sign-in user experience and multifactor authentication (MFA) options for Okta.

Key

Description

AutoAuthenticate

Enable Automatic Sign-in

Determines if Jamf Connect will automatically attempt to sign in the user if there are saved credentials in the user's keychain.

<key>AutoAuthenticate</key>
<false/>

AutoMFA

Automatically Push Last MFA Method

(Okta only) Determines whether the multifactor authentication (MFA) method from a user's last sign-in via Jamf Connect is automatically pushed during their next Jamf Connect sign-in attempt

Note:

Jamf Connect only detects MFA methods used within the menu bar app. MFA methods used during sign-ins to the Okta dashboard via a web browser or another application are not detected.

<key>AutoMFA</key>
<false/>

RequireSignIn

Require Sign-in

Determines if the Sign In window kept open on computers until users successfully authenticate.

<key>RequireSignIn</key>
<false/>

SignInLogo

Sign-in Logo

The file path to a locally stored image to use as a logo. Larger images will be automatically scaled down to an appropriate width whiling maintaining aspect ratio. Do not include a backslash "\" in your file path.

<key>SignInLogo</key>
<string>/usr/local/images/logo.png</string>

UsernameLabel

Username Field Label

Custom text for the Username field in the Sign In window

<key>UsernameLabel</key>
<string>Username:</string>

PasswordLabel

Password Field Label

Custom text for the Password field in the Sign In window

<key>PasswordLabel</key>
<string>Password:</string>

WindowTitle

Sign In Window Title

Custom title for the Sign In window

<key>WindowTitle</key>
<string>Connect</string>

MFARename

MFA Option Names

(Okta only) Custom names for each MFA option used with Okta authentication in your organization. For more information about the types of MFA options you can configure with Jamf Connect and Okta, see Multifactor Authentication.

<key>MFARename</key>

<dict>

<key>push</key>

<string>Okta Verify app: Push Notification</string>

<key>question</key>

<string>Okta Verify app: Security Question</string>

<key>token:hardware</key>

<string>USB Security Key</string>
<key>okta:token:software:totp</key>
<string>Okta Verification Code</string> <key>google:token:software:totp</key>
<string>Google Verification Code</string>

<key>web</key>
<string>Duo Mobile app</string>

</dict>

MFAExcluded

Hidden MFA Options

(Okta only) A list of MFA options that you do not want to display to users

<key>MFAExcluded</key>

<array>

<string>push</string>
<string>question</string>
<string>token:hardware</string>
<string>token:software:totp</string>
<string>web</string>

</array>

OneTimePasswordMessage

One-time Password Message

(Okta only) Text displayed when a user must enter a one-time password (OTP) as a multifactor authentication (MFA) method

<key>OneTimePasswordMessage</key>
<string>Enter the verification code</string> 

Menu Bar Custom Branding Settings

  • Domaincom.jamf.connect
  • DictionaryAppearance
  • Description

    Used to customize Jamf Connect for your organization

Key

Description

MenubarIcon

Light Mode Icon

The file path to a custom icon for the Jamf Connect menu bar icon when Light Mode is enabled

A 16x16 pixel image is recommended.

<key>MenubarIcon</key
<string>/usr/local/icon.png</string>

MenubarIconDark

Dark Mode Icon

The file path to a custom icon for the Jamf Connect menu bar icon that displays when Dark Mode is enabled on macOS 10.15 or earlier

A 16x16 pixel image is recommended.

Note:

This setting is not supported on computers with macOS 11 or later. Use the Light Mode Icon (MenuBarIcon) to upload one icon and allow macOS to automatically change the tint of the icon to clearly display against the user's desktop image.

<key>MenubarIconDark</key
<string>/usr/local/darkicon.png</string>

ShowWelcomeWindow

Show Welcome Window

Display the Welcome window each time Jamf Connect is opened.

<key>ShowWelcomeWindow</key>
<true/>

Unlock App Settings

Domain
com.jamf.connect
Dictonary
Unlock
Description
Used to configure Jamf Unlock app usage in the Jamf Connect menu bar app.

For more information about Jamf Unlock, see Jamf Unlock.

KeyDescription

EnableUnlock

Enable Unlock

Enables Jamf Unlock app usage and displays the Unlock menu items in the menu bar. This setting is set to false by default.

<key>EnableUnlock</key>
<false/> 

RequirePIN

Require PIN

Requires Jamf Unlock users to use a PIN to complete authentication requests.

<key>RequirePIN</key>
<false/> 

User Help Settings

  • Domaincom.jamf.connect
  • DictionaryUserHelp
  • Description

    Used to configure in-app help options for users

Key

Description

HelpType

Get Help Type

The type of help option used by Jamf Connect

Note:

Bomgar, URL and App are supported.

<key>HelpType</key>
<string>URL</string>

HelpOptions

Get Help Options

A URL or file path that users can access by clicking Get Help in the Jamf Connect menu.

Note:

The HelpType key must be specified.

<key>HelpOptions</key>
<string>/Applications/Google Chrome.app</string>

SoftwarePath

Self Service Path

The file path for a Self Service application that Jamf Connect does not automatically find. Jamf Connect will automatically detect Jamf Self Service and Munki Managed Software Center.

<key>SoftwarePath</key>
<string>/Applications/Your.app</string>

Password Policy Settings

  • Domaincom.jamf.connect
  • DictionaryPasswordPolicies
  • Description

    Used to configure network password checks, expiration notifications, and password policies

Key

Description

ExpirationCountdownStartDay

Password Expiration Countdown Start Date

An integer, in days remaining, before the password expiration countdown is displayed in the menu bar next to the app icon. By default, 14 days is used. This setting is disabled when set to 0.

<key>ExpirationCountdownStartDay</key>
<integer>14</integer>

ExpirationManualOverrideDays

Password Expiration Manual Override

(Okta only) An integer, in days, that a user's Okta password is valid for in your organization. For example, if a user must change their Okta password every 90 days, set this value to 90.

This allows Okta administrators to display the amount of days remaining before a user's password expires in the menu bar app for Okta accounts that are not mastered by Active Directory.

To display this value next to the menu bar app icon in addition to in the menu bar, make sure to also configure the Password Expiration Countdown Start Date setting.

Note: If your Okta accounts are mastered by Active Directory, this setting cannot be used. Continue to integrate Jamf Connect with a Kerberos realm and use the Password Expiration Countdown Start Date setting to display the password expiration date in the Jamf Connect menu bar app.

ExpirationNotificationStartDay

Password Expiration Notification Start Date

An integer, in days remaining, before the user begins receiving notifications about an upcoming password expiration. By default, 7 days is used. This setting is disabled when set to 0.

<key>ExpirationNotificationStartDay</key>
<integer>7</integer>

NetworkCheck

Network Check-in Frequency

The check-in frequency that Jamf Connect will use to confirm the network password matches the local password. By default, 15 minutes is used. This setting is disabled when set to 0. Jamf Connect can only check the network password if the network is accessible.

<key>NetworkCheck</key>
<integer>15</integer>

checkOnNetworkChange

Perform Network Checks on Network Changes

Determines whether Jamf Connect performs a network check when a computer's network status changes. This setting is set to true by default. If set to false, Jamf Connect only performs a network check during the the integer defined by the NetworkCheck key.

SyncPasswordsMessage

Sync Passwords Message

A message displayed to users when Jamf Connect detects that their local and network passwords are out of sync.

<key>SyncPasswordsMessage</key>
<string>Your local and network passwords do not match. Enter your current local password to sync it with your network password</string>

PolicyRequirements

Password Policy Requirements

Defines the password complexity policy for changing the password. Jamf Connect will only enforce this setting if a different password policy from Active Directory or a cloud IdP is not detected.

<key>PolicyRequirements</key>

<dict>

<key>minLength</key>

<integer>8</integer>

<key>minLowerCase</key>

<integer>1</integer>

<key>minMatches</key>

<integer>3</integer>

<key>minNumber</key>

<integer>1</integer>

<key>minSymbol</key>

<integer>1</integer>

<key>minUpperCase</key>

<integer>1</integer>
<key>excludeUsername</key>
<true/>

</dict>

PolicyMessage

Password Policy Message

A message that explains your configured password policy. This message only displays when a user tries to set a password that does not meet your password policy requirements.

<key>PolicyMessage</key>
<string>This password does not meet your organization's minimum password complexity requirements.</string>

Kerberos Settings

  • Domaincom.jamf.connect
  • DictionaryKerberos
  • Description

    Used to integrate Jamf Connect with a Kerberos realm for password syncing

Key

Description

Realm

Kerberos Realm

Specifies the Kerberos realm used to get Kerberos tickets. Your Kerberos realm should be written in all caps.

<key>Realm</key>
<string>YOURCOMPANY.NET</string>

AutoRenewTickets

Renew Kerberos Tickets

Determines if the Kerberos tickets should be renewed

<key>AutoRenewTickets</key>
<false/>

CacheTicketsOnNetworkChange

Cache Tickets On Network Change

Determine whether a user's Kerberos tickets are cached or destroyed when a network status changes on computers. When set to true, computers will cache Kerberos tickets when a network change occurs. By default, this setting is set to false and Kerberos tickets are destroyed during a network change.

<key>CacheTicketsOnNetworkChange</key>
<false/> 

ShortName

Custom Short Name

A custom short name to use to obtain Kerberos tickets.

<key>ShortName</key>
<string>Joel</string>

ShortNameAttribute

Short Name Attribute

The ID token attribute to use as a short name. If unspecified, the ShortName value will be used. If no values are found for ShortNameAttribute or ShortName and the AskForShortName key is set to true, the end user will be prompted to enter their short name.

Note:
  • Short Name Attribute cannot be used to specify the short name if MFA is enabled.
  • If Okta is your IdP, you must also have the Client ID (ROPGID) and Tenant ID (TenantID) preference keys configured for Jamf Connect to use the short name specified by ShortNameAttribute.
<key>ShortNameAttribute</key>
<string>attribute</string>

AskForShortName

Ask for Short Name

Determines if the user is asked to enter their Kerberos short name on first sign in

<key>AskForShortName</key>
<false/>

AskForShortNameMessage

Ask for Short Name Message

The message displayed to users when requesting their Kerberos short name

<key>AskForShortNameMessage</key>
<string>Enter your Active Directory username.</string>

Keychain Settings

  • Domaincom.jamf.connect
  • DictionaryKeychain
  • Description

    Used to allow Jamf Connect to sync passwords with keychain items

Key

Description

InternetItems

Sync Password with Internet Keychain Items

Internet accounts that Jamf Connect should sync with the local password.

<key>InternetItems</key>
<dict>
<key>com.apple.network.eap.user.item.wlan.ssid.Company Wireless</key><string>&lt;&lt;shortname&gt;&gt;</string>
</dict>

PasswordItems

Update Keychain Items

Keychain items that Jamf Connect should sync with the local password.


<key>PasswordItems</key>

<dict>

<key>com.apple.network.eap.user.item.wlam.ssid.SSIDNameHere</key>

<string>&lt;&lt;shortname&gt;&gt;</string>

</dict>


Okta Web Browser Settings

  • Domaincom.jamf.connect
  • DictionaryWebBrowser
  • Description

    Used to manage whether a user's Okta dashboard opens on sign-in and in what browser

Key

Description

LaunchBrowser

Determines whether the Okta dashboard is opened in a web browser when a user signs in with Jamf Connect.

<key>LaunchBrowser</key>
<false/>

BrowserSelection

Determines which browser the Okta dashboard is opened in when a user signs in with Jamf Connect by enforcing a selection from the Browser pop-up menu at the Sign In window. Safari, Firefox, and Google Chrome are supported browsers.

<key>BrowserSelection</key>
<string>Google Chrome</string>

Menu Item Customization Settings

  • Domaincom.jamf.connect
  • DictionaryCustomMenuItems
  • Description

    Used to customize the names of menu items in Jamf Connect

Key

Description

About

About Menu Text

Title of the About menu item

<key>about</key>
<string>About</string>

Actions

Actions Menu Text

Title of the Actions menu item

<key>actions</key>
<string>Actions</string>

ChangePassword

Change Password Menu Text

Title of the Change Password menu item

<key>changepassword</key>
<string>Change Password</string>

GetHelp

Get Help Menu Text

Title of the Get Help menu item

<key>gethelp</key>
<string>Get Help</string>

GetSoftware

Get Software Menu Text

Title of the Get Software menu item

<key>getsoftware</key>
<string>Get Software</string>

Home

Home Directory Menu Text

Title of the Home directory menu item

<key>homedirectory</key>
<string>Home</string>

KerberosTickets

Kerberos Ticket Menu Text

Title of the Kerberos Tickets menu item

<key>kerberostickets</key>
<string>Kerberos Tickets</string>

Preferences

Preferences Menu Text

Title of the Preferences menu item

<key>preferences</key>
<string>Preferences</string>

ResetPassword

Reset Password Menu Text

Title of the reset password menu item

<key>resetpassword</key>
<string>Reset Password</string>

Shares

Shares Menu Text

Title of the shares menu item

<key>shares</key>
<string>Shares</string>

Connect

Connect Menu Text

Title of the Connect menu item

<key>connect</key>
<string>Connect</string>

Menu Item Display Settings

  • Domaincom.jamf.connect
  • KeyHiddenMenuItems
  • Description

    An array of strings used to hide Jamf Connect menu items from users

Value

Description

about

Hide About Menu Item
 Hides the About window

<key>HiddenMenuItems</key>
<array>
<string>about</string>
</array>

actions

Hide Actions Menu Item

Hides the custom configured Actions menu item.

<key>HiddenMenuItems</key>
<array>
<string>actions</string>
</array>

changepassword

Hide Change Passwords Menu Item

Hides the Change Password menu item

<key>HiddenMenuItems</key>
<array>
<string>changepassword</string>
</array>

gethelp

Hide Get Help Menu Item

Hides the Get Help menu

<key>HiddenMenuItems</key>
<array>
<string>gethelp</string>
</array>

getsoftware

Hide Get Software Menu Item

Hides the Get Software menu

Note:

If a self-service app is not installed on computers, this menu item is hidden by default.

<key>HiddenMenuItems</key>
<array>
<string>getsoftware</string>
</array>

home

Hide Home Directory Menu Item

Hides the home directory menu item

Note:

If a home share is not detected, this menu item is hidden by default

<key>HiddenMenuItems</key>
<array>
<string>home</string>
</array>

tickets

Hide Kerberos Ticket Menu Item

Hides the Tickets menu item

Note:

If a Kerberos realm is not configured, this menu item is hidden by default.

<key>HiddenMenuItems</key>
<array>
<string>tickets</string>
</array>

lastuser

Hide Last User Menu Item

Hides the last user menu item

<key>HiddenMenuItems</key>
<array>
<string>lastuser</string>
</array>

passwordexpiration

Hide Password Expiration Menu Item

Hides the Password Expiration menu item

<key>HiddenMenuItems</key>
<array>
<string>passwordexpiration</string>
</array> 

preferences

Hide Preferences Menu Item

Hides the Preferences menu item

<key>HiddenMenuItems</key>
<array>
<string>preferences</string>
</array> 

resetpassword

Hide Reset Password Menu Item

Hides the reset password menu item

<key>HiddenMenuItems</key>
<array>
<string>resetpassword</string>
</array> 

shares

Hide Shares Menu Item

Hide the Share menu item

<key>HiddenMenuItems</key>
<array>
<string>shares</string>
</array>

connect

Hide Connect Menu Item

Hides the Connect menu item

<key>HiddenMenuItems</key>
<array>
<string>connect</string>
</array>

quitjamfconnect

Hide Quit Menu Item

Hides the Quit menu item

<key>HiddenMenuItems</key>
<array>
<string>quitjamfconnect</string>
</array> 

Menu Bar Script Settings

  • Domaincom.jamf.connect
  • DictionaryScripting
  • Description

    Used to run custom scripts that are triggered by Jamf Connect authentication events

Key

Description

OnPasswordChange

Password Change Script

The file path to a script or other binary to run after successful password change

<key>OnPasswordChange</key>
<string>/usr/local/bin/PasswordChange.sh</string>

OnAuthSuccess

Successful Sign-in Script

The file path to a script or other binary to run after a successful Jamf Connect authentication

<key>OnAuthSuccess</key>
<string>/usr/local/bin/JamfConnectAuth.sh</string>

OnAuthFailure

Failed Sign-in Script

The file path to a script or other binary to run after an unsuccessful Jamf Connect authentication attempt

<key>OnAuthFailure</key>
<string>/usr/local/bin/JamfConnectAuthFailure.sh</string>

OnNetworkChange

Network Change Script

The file path to a script or other binary to execute after a network change is detected

<key>OnNetworkChange</key>
<string>/usr/local/bin/JamfConnectAuthFailure.sh</string>

Certificate Settings

  • Domaincom.jamf.connect
  • DictionaryCertificates
  • Description

    Used to configure Windows web CA settings

Key

Description

WindowsCA

X.509 Certificate Authority

Specifies the URL of the Windows web certificate authority (CA) for Jamf Connect to use for certificates

<key>WindowsCA</key>
<string>dc1.jamfconnect.test</string>

CertificateTemplate

Certificate Template

Certificate template from a Windows web CA

<key>CertificateTemplate</key>
<string>User Auth</string>

GetCertificateAutomatically

Get Certificates Automatically

Enables Jamf Connect to get a certificate from a Windows web CA automatically on sign-in

<key>GetCertificateAutomatically</key>
<false/>

SecureNetworks

Associated Wi-Fi Networks

A list of secure wireless networks to associate with the certificate Jamf Connect created

<key>SecureNetworks</key>
<array>
<string>SSID1</string>
<string>SSID2</string>
</array

ExportableCertificateKey

Allow Private Key Exports

Allow the private key of the user certificate to be exported

<key>ExportableCertificateKey</key>
<false/>