JAMF AND AZURE AD PRO
JAMF AND AZURE AD TRIAL
JAMF AND AZURE AD PASSWORD
JAMF AND AZURE AD DOWNLOAD

The Group Attribute Name (which doesn't work, BTW) should be ''. '').Īlso, you need to specify the User Mapping in SAML and JSS as, respectively, NameID and Email. Set Identity Provider to 'other', give it a name and upload the metadata XML from Azure AD under Identity Provider Metadata Source, make JSS generate a signing certificate, and specify the same Entity ID as in Azure ID (eg. Instead reads: 'groupMembershipClaims': 'All', Do so, and make sure that the following line: 'groupMembershipClaims': null, Under Properties/Settings, make sure that: Home Page URL: Īlso, under Reply URLs, there should be an entry of īack to the main page of the App Registrant for your Jamf SSO, you should be able to click to edit the Manifest. Now, go back to Azure Active Directory in the Azure Portal, and choose your new application from the list in App Registrants. Or, you may do it later, but it is needed for setting up the JSS.

JAMF AND AZURE AD DOWNLOAD

Generate a new signing certificate, and make sure to download the resulting Metadata XML for later. Under Single Sign-On, choose 'SAML-based Sign-On'. You will be asked for the homepage of the application, and it should be like ''.

JAMF AND AZURE AD PRO

Make a name, like Jamf Pro SSO, and continue. So, provided you can create a Non-Gallery Application in your Azure AD (under Enterprise Applications > All Enterprise applications), do so.

JAMF AND AZURE AD TRIAL

And to be able to add a custom enterprise application, you need to have at least a trial license of Active Directory Premium.

JAMF AND AZURE AD PASSWORD

With this setup, it should be possible to login to Jamf Pro with a O365 account, provided that the password is reset after adding Domain Services to Azure AD.įor Azure AD SSO, most of the work is done setting up a custom enterprise application in Azure AD. User Group Memberships uses the User object to store its memberships, in the attribute MemberOf.Īnd that is that for setting up LDAP with Azure AD. The User Mapping is mostly standard, but beware to use the Search Base 'OU=AADDC Users, dc=yourADdomain, dc=com'. The mappings were a bit time consuming to figure out. The account must be specified as not the DN type suggested. Beware that this account must have its password set AFTER you set up Domain Services in order to work. Use the simple authentication type, and make a service account in Azure AD to authenticate with. The port will always be 636, and you need to upload the SSL certificate, both to Azure and to the Jamf server, like we have done here. In our example, we are using the AD domain 'dibk.no', so we have defined an LDAP server in the AADDS setup. The LDAP setup is really simple, but there are some distinct differences to other LDAP setups. But use it for smart groups, user lookups and so on. Bottom line: Don't use AD LDAP as login mechanism in Jamf unless you really have to. Also, the new passwords operate on another time schedule than Azure AD's password policy, so they may stop working.

So, with this working, you need to know that LDAP login with Azure ADDS is possible, but the users' passwords must be reset before it works. It is easy to set up, but requires a DNS entry (a name that points to the public IP address of the new LDAP server) and an SSL certificate that works with the given DNS entry. At this time, this service is available for all Azure subscriptions except CSP subscriptions. This means, you have to set up the service Azure Active Directory Domain Services with external LDAPS support. Therefore, I decided to share our experiences using Azure AD as a authorization provider for Jamf Pro.įirst, LDAP is necessary in order to get user and group lookups to work. I see that a growing number of organizations are migrating on-premise AD to Azure AD.

Jamf and azure ad