Jamf Pro

Jamf Pro

Single Sign On with Cloudwork

1. Login to Cloudwork dashboard
2. Navigate to Single Sign On>Add New Service>Custom SAML Service
3. Fill out the form:

   Name = Jamf Pro

   Entity ID:

   • If using Jamf OnPremise, use for Entity ID: https://<Jamf Pro domain>:8443/saml/metadata
   • If using Jamfcloud hosted server, use for Entity ID: https://<Jamf Pro URL>/saml/metadata

   ACS:

   • If using Jamf OnPremise, use for ACS: https://<Jamf Pro domain>:8443/saml/SSO
   • If using Jamfcloud hosted server, use for ACS: https://<Jamf Pro URL>/saml/SSO

   Single Logout Service = Leave blank

   NameID Value = From the drop down select Email

   NameID Format = select from drop down urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

   Login URL:

   • If using Jamf OnPremise, use for Login URL: https://<Jamf Pro domain>:8443
   • If using Jamfcloud hosted server, use for Login URL: https://<Jamf Pro URL>

4. Click Submit
5. Under XML File click download and save file as .XML file

Example of Cloudwork Setup

Single Sign On with Jamf Pro

1. Login to your Jamf Pro dashboard
2. In the top right corner click the gear
3. Under System Settings click on Single Sign On
4. In the bottom left corner click Edit and turn on Single Sign-On Authentication
5. Fill out the form:

   Identity Provider = Other

   Other Provider = Enter in Cloudwork

   Entity ID:

   • If using Jamf OnPremise, use for Entity ID: https://<Jamf Pro domain>:8443/saml/metadata
   • If using Jamfcloud hosted server, use for Entity ID: https://<Jamf Pro URL>/saml/metadata

   Identity Provider Metadata Source = select Metadata File

   Upload Metadata File = Upload the XML File which was downloaded from Cloudwork Dashboard.

   Token Expiration Time Override = Leave at 480

   Identity Provider User Mapping = Set to NameID

   Jamf Pro User Mapping = Set to Email

   Identity Provider Group Attribute Name = Set to https://scopes.cloudwork.id/profile

   RDN Key For LDAP Group = Leave blank

   Options: Select the following options

   • Single Sign-On Options for Jamf Pro
   • Allow users to bypass the Single Sign-On authentication (Optional Choice)
   • Enable Single Sign-On for Self Service for macOS
   • Enable Single Sign-On for User-Initiated Enrollment
   • Enrollment Access = Set to Any Identity provider user

6. Click Save

Example of Jamf Pro Setup part 1

Example of Jamf Pro Setup part 2

Testing Single Sign On

1. Login to your Jamf Pro Dashboard
2. In the top right corner click the gear
3. Click Jamf Pro User Accounts & Groups
4. Click New
5. For Choose Action select Create standard Account and click Next
6. Populate your test user details:

   Notes for populating test user:

   • Ensure Username is full email address, and email address field is populated.
   • Password entered here will be ignored

   Test SSO by opening a private browsing session and log into your Jamf Pro Server:

   • If using Jamf OnPremise, login to: https://<Jamf Pro domain>:8443/saml/metadata
   • If using Jamfcloud hosted server, login to: https://<Jamf Pro URL>/saml/metadata