Menu Bar App Preferences

Provider

Identity Provider

(Required) The name of your cloud identity Provider. The following values are supported:

• Azure
• IBMCI
• Okta
• OneLogin
• PingFederate
• Custom

<key>Provider</key>
<string>Azure</key>

OktaAuthServer

Okta Auth Server

(Required: Okta Only) Your organization's Okta domain. A preceding "https://" is optional.

<key>OktaAuthServer</key>
<string>your-company.okta.com</string>

ROPGID

Client ID

(Required: OpenID Connect only) The client ID of your Jamf Connect app in your IdP. This value allows Jamf Connect to complete a resource owner password grant (ROPG), which is the process that performs password verification.

<key>ROPGID</key>
<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

DiscoveryURL

Discovery URL

Your IdP's OpenID Connect discovery endpoint. This value appears in the following format: https://domain.url.com/.well-known/openid-configuration

If using AD FS, this value is your AD FS domain combined with the following: /adfs/.well- known/openid-configuration\

<key>DiscoveryURL</key>
<string>https://domain.url.com/.well-known/openid-configuration</string>

TenantID

Tenant ID

The Tenant ID for your organization used for authentication.

<key>TenantID</key>
<string>companyname</string>

ChangePasswordURL

Change Password URL

A URL to a password change web page supported by your IdP

<key>ChangePasswordURL</key>
<string>https://idp.example.com/.well-known/change-password</string> 

ResetPasswordURL

Reset Password URL

A URL to a password reset web page supported by your IdP

<key>ResetPasswordURL</key>
<string>https://idp.example.com/.well-known/reset-password</string>

ClientSecret

Client Secret

The client secret of your Jamf Connect app in your IdP.

<key>ClientSecret</key>
<string>yourClientSecret</string>

SuccessCodes

Password Verification Success Codes

An array of strings that contain error codes from your IdP during an ROPG password verification, which should be interpreted as successful by Jamf Connect.

For possible error codes that may need to be configured in your environment, see the Azure AD Authentication and authorization error codes documentation from Microsoft.

If using OneLogin, set this key to "MFA", if multifactor authentication is used in your environment.

<key>SuccessCodes</key>
<array>
<string>AADSTS50012</string>
<string>AADSTS50131</string>
</array>

AutoAuthenticate

Enable Automatic Sign-in

Determines if Jamf Connect will automatically attempt to sign in the user if there are saved credentials in the user's keychain.

<key>AutoAuthenticate</key>
<false/>

AutoMFA

Automatically Push Last MFA Method

(Okta only) Determines whether the multifactor authentication (MFA) method from a user's last sign-in via Jamf Connect is automatically pushed during their next Jamf Connect sign-in attempt

<key>AutoMFA</key>
<false/>

Set Jamf Connect as a login item for users. This setting is set to false by default.

<key>AutoOpenAppAtLogin</key>
<false/>

RequireSignIn

Require Sign-in

Determines if the Sign In window kept open on computers until users successfully authenticate.

<key>RequireSignIn</key>
<false/>

SignInLogo

Sign-in Logo

The file path to a locally stored image to use as a logo. Larger images will be automatically scaled down to an appropriate width whiling maintaining aspect ratio. Do not include a backslash "\" in your file path.

<key>SignInLogo</key>
<string>/usr/local/images/logo.png</string>

UsernameLabel

Username Field Label

Custom text for the Username field in the Sign In window

<key>UsernameLabel</key>
<string>Username:</string>

PasswordLabel

Password Field Label

Custom text for the Password field in the Sign In window

<key>PasswordLabel</key>
<string>Password:</string>

WindowTitle

Sign In Window Title

Custom title for the Sign In window

<key>WindowTitle</key>
<string>Connect</string>

MFARename

MFA Option Names

(Okta only) Custom names for each MFA option used with Okta authentication in your organization. For more information about the types of MFA options you can configure with Jamf Connect and Okta, see Multifactor Authentication.

<key>MFARename</key>

<dict>

   <key>push</key>

   <string>Okta Verify app: Push Notification</string>

   <key>question</key>

   <string>Okta Verify app: Security Question</string>

   <key>token:hardware</key>

   <string>USB Security Key</string>

   <key>okta:token:software:totp</key>

   <string>Okta Verification Code</string>
   <key>google:token:software:totp</key>

   <string>Google Verification Code</string>

   <key>web</key>

   <string>Duo Mobile app</string>

</dict>

MFAExcluded

Hidden MFA Options

(Okta only) A list of MFA options that you do not want to display to users

<key>MFAExcluded</key>

<array>

   <string>push</string>

   <string>question</string>

   <string>token:hardware</string>

   <string>okta:token:software:totp</string>
   <string>google:token:software:totp</string>

   <string>web</string>

</array>

OneTimePasswordMessage

One-time Password Message

(Okta only) Text displayed when a user must enter a one-time password (OTP) as a multifactor authentication (MFA) method

<key>OneTimePasswordMessage</key>
<string>Enter the verification code</string> 

MenubarIcon

Light Mode Icon

The file path to a custom icon for the Jamf Connect menu bar icon when Light Mode is enabled

A 16x16 pixel image is recommended.

<key>MenubarIcon</key
<string>/usr/local/icon.png</string>

MenubarIconDark

Dark Mode Icon

The file path to a custom icon for the Jamf Connect menu bar icon that displays when Dark Mode is enabled on macOS 10.15 or earlier

A 16x16 pixel image is recommended.

<key>MenubarIconDark</key
<string>/usr/local/darkicon.png</string>

Use Unbranded App Icon

<key>AlternateBranding</key>
<false/>

ShowWelcomeWindow

Show Welcome Window

Display the Welcome window each time Jamf Connect is opened.

<key>ShowWelcomeWindow</key>
<true/>

HelpType

Get Help Type

The type of help option used by Jamf Connect

<key>HelpType</key>
<string>URL</string>

HelpOptions

Get Help Options

A URL or file path that users can access by clicking Get Help in the Jamf Connect menu.

<key>HelpOptions</key>
<string>/Applications/Google Chrome.app</string>

SoftwarePath

Self Service Path

The file path for a Self Service application that Jamf Connect does not automatically find. Jamf Connect will automatically detect Jamf Self Service and Munki Managed Software Center.

<key>SoftwarePath</key>
<string>/Applications/Your.app</string>

ExpirationCountdownStartDay

Password Expiration Countdown Start Date

An integer, in days remaining, before the password expiration countdown is displayed in the menu bar next to the app icon. By default, 14 days is used. This setting is disabled when set to 0.

<key>ExpirationCountdownStartDay</key>
<integer>14</integer>

ExpirationManualOverrideDays

Password Expiration Manual Override

(Okta only) An integer, in days, that a user's Okta password is valid for in your organization. For example, if a user must change their Okta password every 90 days, set this value to 90.

This allows Okta administrators to display the amount of days remaining before a user's password expires in the menu bar app for Okta accounts that are not mastered by Active Directory.

To display this value next to the menu bar app icon in addition to in the menu bar, make sure to also configure the Password Expiration Countdown Start Date setting.

ExpirationNotificationStartDay

Password Expiration Notification Start Date

An integer, in days remaining, before the user begins receiving notifications about an upcoming password expiration. By default, 7 days is used. This setting is disabled when set to 0.

<key>ExpirationNotificationStartDay</key>
<integer>7</integer>

NetworkCheck

Network Check-in Frequency

The check-in frequency that Jamf Connect will use to confirm the network password matches the local password. By default, 15 minutes is used. This setting is disabled when set to 0. Jamf Connect can only check the network password if the network is accessible.

<key>NetworkCheck</key>
<integer>15</integer>

CheckOnNetworkChange

Perform Network Checks on Network Changes

<key>CheckOnNetworkChange</key>
<true/>

SyncPasswordsMessage

Sync Passwords Message

A message displayed to users when Jamf Connect detects that their local and network passwords are out of sync.

<key>SyncPasswordsMessage</key>
<string>Your local and network passwords do not match. Enter your current local password to sync it with your network password</string>

PolicyRequirements

Password Policy Requirements

Defines the password complexity policy for changing the password. Jamf Connect will only enforce this setting if a different password policy from Active Directory or a cloud IdP is not detected.

<key>PolicyRequirements</key>

<dict>

<key>minLength</key>

<integer>8</integer>

<key>minLowerCase</key>

<integer>1</integer>

<key>minMatches</key>

<integer>3</integer>

<key>minNumber</key>

<integer>1</integer>

<key>minSymbol</key>

<integer>1</integer>

<key>minUpperCase</key>

<integer>1</integer>
<key>excludeUsername</key>
<true/>

</dict>

PolicyMessage

Password Policy Message

A message that explains your configured password policy. This message only displays when a user tries to set a password that does not meet your password policy requirements.

<key>PolicyMessage</key>
<string>This password does not meet your organization's minimum password complexity requirements.</string>

Realm

Kerberos Realm

Specifies the Kerberos realm used to get Kerberos tickets. Your Kerberos realm should be written in all caps.

<key>Realm</key>
<string>YOURCOMPANY.NET</string>

AutoRenewTickets

Renew Kerberos Tickets

Determines if the Kerberos tickets should be renewed

<key>AutoRenewTickets</key>
<false/>

CacheTicketsOnNetworkChange

Cache Tickets On Network Change

Determine whether a user's Kerberos tickets are cached or destroyed when a network status changes on computers. When set to true, computers will cache Kerberos tickets when a network change occurs. By default, this setting is set to false and Kerberos tickets are destroyed during a network change.

<key>CacheTicketsOnNetworkChange</key>
<false/> 

ShortName

Custom Short Name

A custom short name to use to obtain Kerberos tickets.

<key>ShortName</key>
<string>Joel</string>

ShortNameAttribute

Short Name Attribute

The ID token attribute to use as a short name. If unspecified, the ShortName value will be used. If no values are found for ShortNameAttribute or ShortName and the AskForShortName key is set to true, the end user will be prompted to enter their short name.

<key>ShortNameAttribute</key>
<string>attribute</string>

AskForShortName

Ask for Short Name

Determines if the user is asked to enter their Kerberos short name on first sign in

<key>AskForShortName</key>
<false/>

AskForShortNameMessage

Ask for Short Name Message

The message displayed to users when requesting their Kerberos short name

<key>AskForShortNameMessage</key>
<string>Enter your Active Directory username.</string>

InternetItems

Sync Password with Internet Keychain Items

Internet accounts that Jamf Connect should sync with the local password.

<key>InternetItems</key>
<dict>
<key>com.apple.network.eap.user.item.wlan.ssid.Company Wireless</key><string>&lt;&lt;shortname&gt;&gt;</string>
</dict>

PasswordItems

Update Keychain Items

Keychain items that Jamf Connect should sync with the local password.


<key>PasswordItems</key>

<dict>

<key>com.apple.network.eap.user.item.wlam.ssid.SSIDNameHere</key>

<string>&lt;&lt;shortname&gt;&gt;</string>

</dict>


LaunchBrowser

Launch Browser

Determines whether the Okta dashboard is opened in a web browser when a user signs in with Jamf Connect.

<key>LaunchBrowser</key>
<false/>

BrowserSelection

Browser Selection

Determines which browser the Okta dashboard is opened in when a user signs in with Jamf Connect by enforcing a selection from the Browser pop-up menu at the Sign In window. Safari, Firefox, and Google Chrome are supported browsers.

<key>BrowserSelection</key>
<string>Google Chrome</string>

About

About Menu Text

Title of the About menu item

<key>about</key>
<string>About</string>

Actions

Actions Menu Text

Title of the Actions menu item

<key>actions</key>
<string>Actions</string>

ChangePassword

Change Password Menu Text

Title of the Change Password menu item

<key>changepassword</key>
<string>Change Password</string>

GetHelp

Get Help Menu Text

Title of the Get Help menu item

<key>gethelp</key>
<string>Get Help</string>

GetSoftware

Get Software Menu Text

Title of the Get Software menu item

<key>getsoftware</key>
<string>Get Software</string>

Home

Home Directory Menu Text

Title of the Home directory menu item

<key>homedirectory</key>
<string>Home</string>

KerberosTickets

Kerberos Ticket Menu Text

Title of the Kerberos Tickets menu item

<key>kerberostickets</key>
<string>Kerberos Tickets</string>

Preferences

Preferences Menu Text

Title of the Preferences menu item

<key>preferences</key>
<string>Preferences</string>

ResetPassword

Reset Password Menu Text

Title of the reset password menu item

<key>resetpassword</key>
<string>Reset Password</string>

Shares

Shares Menu Text

Title of the shares menu item

<key>shares</key>
<string>Shares</string>

Connect

Connect Menu Text

Title of the Connect menu item

<key>connect</key>
<string>Connect</string>

about

Hide About Menu Item

Hides the About window

<key>HiddenMenuItems</key>
<array>
<string>about</string>
</array>

actions

Hide Actions Menu Item

Hides the custom configured Actions menu item

<key>HiddenMenuItems</key>
<array>
<string>actions</string>
</array>

changepassword

Hide Change Passwords Menu Item

Hides the Change Password menu item

<key>HiddenMenuItems</key>
<array>
<string>changepassword</string>
</array>

gethelp

Hide Get Help Menu Item

Hides the Get Help menu

<key>HiddenMenuItems</key>
<array>
<string>gethelp</string>
</array>

getsoftware

Hide Get Software Menu Item

Hides the Get Software menu

<key>HiddenMenuItems</key>
<array>
<string>getsoftware</string>
</array>

home

Hide Home Directory Menu Item

Hides the home directory menu item

<key>HiddenMenuItems</key>
<array>
<string>home</string>
</array>

tickets

Hide Kerberos Ticket Menu Item

Hides the Tickets menu item

<key>HiddenMenuItems</key>
<array>
<string>tickets</string>
</array>

lastuser

Hide Last User Menu Item

Hides the last user menu item

<key>HiddenMenuItems</key>
<array>
<string>lastuser</string>
</array>

passwordexpiration

Hide Password Expiration Menu Item

Hides the Password Expiration menu item

<key>HiddenMenuItems</key>
<array>
<string>passwordexpiration</string>
</array> 

preferences

Hide Preferences Menu Item

Hides the Preferences menu item

<key>HiddenMenuItems</key>
<array>
<string>preferences</string>
</array> 

resetpassword

Hide Reset Password Menu Item

Hides the reset password menu item

<key>HiddenMenuItems</key>
<array>
<string>resetpassword</string>
</array> 

shares

Hide Shares Menu Item

Hide the Share menu item

<key>HiddenMenuItems</key>
<array>
<string>shares</string>
</array>

connect

Hide Connect Menu Item

Hides the Connect menu item

<key>HiddenMenuItems</key>
<array>
<string>connect</string>
</array>

quitjamfconnect

Hide Quit Menu Item

Hides the Quit menu item

<key>HiddenMenuItems</key>
<array>
<string>quitjamfconnect</string>
</array> 

OnPasswordChange

Password Change Script

The file path to a script or other binary to run after successful password change

<key>OnPasswordChange</key>
<string>/usr/local/bin/PasswordChange.sh</string>

OnAuthSuccess

Successful Sign-in Script

The file path to a script or other binary to run after a successful Jamf Connect authentication

<key>OnAuthSuccess</key>
<string>/usr/local/bin/JamfConnectAuth.sh</string>

OnAuthFailure

Failed Sign-in Script

The file path to a script or other binary to run after an unsuccessful Jamf Connect authentication attempt

<key>OnAuthFailure</key>
<string>/usr/local/bin/JamfConnectAuthFailure.sh</string>

OnNetworkChange

Network Change Script

The file path to a script or other binary to execute after a network change is detected

<key>OnNetworkChange</key>
<string>/usr/local/bin/JamfConnectAuthFailure.sh</string>

WindowsCA

X.509 Certificate Authority

Specifies the URL of the Windows web certificate authority (CA) for Jamf Connect to use for certificates

<key>WindowsCA</key>
<string>dc1.jamfconnect.test</string>

CertificateTemplate

Certificate Template

Certificate template from a Windows web CA

<key>CertificateTemplate</key>
<string>User Auth</string>

GetCertificateAutomatically

Get Certificates Automatically

Enables Jamf Connect to get a certificate from a Windows web CA automatically on sign-in

<key>GetCertificateAutomatically</key>
<false/>

SecureNetworks

Associated Wi-Fi Networks

A list of secure wireless networks to associate with the certificate Jamf Connect created

<key>SecureNetworks</key>
<array>
<string>SSID1</string>
<string>SSID2</string>
</array

ExportableCertificateKey

Allow Private Key Exports

Allow the private key of the user certificate to be exported

<key>ExportableCertificateKey</key>
<false/>