Integrate Azure Active Directory with Jamf Pro

Slide 1

Slide 1 text

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

© JAMF Software, LLC Integrate Azure Active Directory with Jamf Pro Presentation agenda: Create an Office 365/Azure Account Configure Azure AD Domain Services & Secure LDAP Configure Azure for SSO Enable LDAP and SSO in Jamf Pro Look at different ways of provisioning access

Slide 6

Slide 6 text

© JAMF Software, LLC Preface Azure Active Directory Domain Services What is Azure AD Domain Services? - Cloud AD environment - Replicates from Azure AD (And by proxy on-prem AD if using Azure AD Connect sync) - Extends your on-prem AD environment to Azure without having to managed DC VM’s and maintaining a persistent VPN connection to Azure How are we leveraging this? - Using secure LDAP feature - LDAP integration in Jamf Pro, User Assignment / Authentication

Slide 7

Slide 7 text

© JAMF Software, LLC Where would this be useful? A Story Oceanic Airlines Oceanic Airlines is a lean airline startup with a “Cloud First” mentality. Environment - Uses Oﬃce 365 and Azure AD as their IDP - Has no traditional on-prem infrastructure, no on premise directory - Uses Cloud Flare - Has decided to invest in macOS and iOS - Has chosen Jamf Pro as their MDM - Needs to easily integrate Jamf Pro with their Azure environment for SSO and LDAP

Slide 8

Slide 8 text

© JAMF Software, LLC Where else? Diﬀerent Organizations Concerns - Security focussed organizations that would rather have a cloud service “talk” to another cloud service. - Organizations that have traditional infrastructure and on premise directories, but don’t have a DMZ or don’t want to expose another on-premise service. - Any org that doesn’t want to allow Jamf Cloud to reach their network but still want to use the LDAP feature.

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Slide 42

Slide 42 text

© JAMF Software, LLC What are we matching? For an individual account - We are matching the Azure username to the Jamf username - This can be customized For group based access - We are matching the SSO “memberOf” claim to a group in Jamf Pro

Slide 43

Slide 43 text

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Slide 46

Slide 46 text

Slide 47

Slide 47 text

Slide 48

Slide 48 text

Slide 49

Slide 49 text

© JAMF Software, LLC Why did we add a standard group? In order to leverage groups to authenticate SSO users we must create a standard group with the Azure Object ID as the name. Microsoft does not send the “Plain Text” group name in the SAML assertion for Jamf to match to the LDAP group name.

Slide 50

Slide 50 text

© JAMF Software, LLC Why the odd permissions? We used these precise permissions to ensure that administrators logging in via SSO cannot bypass or adjust SSO settings. An Example of why we would want to do this is to enforce conditional access on admins.

Slide 51

Slide 51 text

Slide 52

Slide 52 text

Slide 53

Slide 53 text

Slide 54

Slide 54 text

Slide 55

Slide 55 text

Slide 56

Slide 56 text

© JAMF Software, LLC Why SSO and LDAP? Why do we need to be able to login as both an LDAP user and an SSO user? - SSO protects the Web App, UIE and Enrollment Customization - LDAP can be used for the “Classic” Jamf Pro apps like Recon, Admin, Remote, Imagining (please don’t image) as well as user assignment and lookups - LDAP accounts can also be used when making API calls

Slide 57

Slide 57 text

© JAMF Software, LLC Tools Tools & Troubleshooting -SAML Tracer (Firefox) for SSO issues. -LDAP Admin tool for troubleshooting LDAP connection and mapping -Use Firefox or Chrome to conﬁgure Azure -Single Sign on Errors with Jamf Pro? Clear the cookies.