Set the Privilege Set to at minimum “Enrollment Only.” Administrators may wish to customize the Privileges as they see fit. For example, if a group should enroll devices directly into a site instead of being shown a selection of sites, select Site Access and pick the appropriate site.
#Jamf pro sso full
Set Access Level to either Full or Site depending on the administrator’s needs. Set Display Name of the group to the group name in the SAML token who should receive access to enroll a device. The name of the group is what will be pattern matched to the list of groups in the SAML token.)
#Jamf pro sso pro
(Note: If you have LDAP configured on your Jamf Pro server and if the source of the name of the group is the same for LDAP as the group names in the token, you can make either an LDAP group or a Standard group. Navigate to Settings → System Settings → Jamf Pro User Accounts & Groups. Step Three: Create groups in Jamf Pro Users and Groups Validate that the SAML token is passing a group membership as part of the claims, and record the group name or names for access to the next step.
5d6b6bb7-de71-4623-b4af-96380a352509) instead of the actual sAMAccountName.) An attribute with groups may contain one single group or multiple groups depending on how the SAML application is configured in the identity provider. (Note: In pure Azure environments, the group name may correspond to the UUID of the group’s identifier in Azure (e. The string between the tags is the name of a group that user belongs to. The group claim will look something like the sample below: A section named will contain “claims” or attributes of the user including, if enabled, groups to which the user belongs. Sign into the Jamf Pro server administration page and capture the SAML token used for the login.Ī SAML identity token is an XML formatted text file. Use a SAML inspector tool like the SAML Message Decoder - in a web browser like Google Chrome or Microsoft Edge. Step Two: Examine the SAML token for Jamf Pro SSO In the “Configure Enrollment Access For:” section, select “Only this group” and enter the name of a group that does not exist in your identity provider. Navigate to Settings → Enrollment Customizations, select the name of your enrollment customization, and edit the pane that contains Single Sign-On: Optional: If you are using Enrollment Customization for automated device enrollment, you can limit access to one, non-existant group as well. In the section marked “Only this group”, add the name of a group that will not ever exist in your identity provider, in this case, a group named “thisgroupdoesntexist”. On the bottom of the page in Jamf Pro → Settings → Single Sign-On, modify the Single Sign-On Options for Jamf Pro under the section “Enable Single Sign-On for User-Initiated Enrollment”. Step One: Set up Single Sign-On and limit enrollmentįollow the instructions at to set up Single Sign-On for your identity provider in Jamf Pro. Create groups in Jamf Pro Users and Groups that match the corresponding group names in the SAML token.Examine the SAML token for Jamf Pro SSO to make sure groups are included in the claim attributes.Set up Single Sign-On and limit to a group that does not exist.
0 kommentar(er)
