Hi all!

This is going to be a very quick post as I just want to highlight and clarify something. This being the new feature which has been added to Jamf Connect Login in view of how the password validation via ROPG is done during account creation or subsequent logins.

Starting with Jamf Connect Login 2.5 (for Google iDP) and 2.6 for (Azure iDP) a new key has been added to the available preferences: OIDCUsePassthroughAuth.

This with the following release notes: https://docs.jamf.com/jamf-connect/documentation/Release_History.html

This allows Jamf Connect to complete network and local authentication without prompting users to re-enter a password. During local account creation, this ensures that the network password is automatically used as the local password.

Prior to this new key the account creation or subsequent login with Jamf Connect would typically look like this:

First authentication done through the iDP webapp:

After that, depending your ROPG settings (OIDCNewPassword) you would either see a request to re-enter the password (if you set OIDCNewPassword to false)…

… or choose a new password (if you set OIDCNewPassword to true)…:

Now, with the new OIDCUsePassthroughAuth key you can configure Jamf Connect Login in a way that the end user only needs to authenticate 1x, through the OIDC webapp.

The way this works is that the authentication is now securely ‘passed through’ to the Jamf Connect Login mechs running in the background. This for account creation as well as subsequent logins.

Note: for this to work for account creation the OIDCNewPassword key needs to be set to false. If not set, this key is set to true by default. If not set to false the end user will be requested to choose a password during account creation, which will obstruct this OIDCUsePassthroughAuth to work.

To enable this feature, the only thing you need to do is to add this specific key to the Jamf Connect Login plist and re-push the profile, as well as update Jamf Connect to 2.5/2.6 depending the iDP you use:

<key>OIDCUsePassthroughAuth</key>
<true/>    
<key>OIDCNewPassword</key>
<false/>

This enhances the user experience avoiding the need to authenticate 2x for every login. However, some considerations still need to be taken into account in view of FileVault.

I’ve discussed this behaviour here: https://travellingtechguy.blog/?p=4119&preview=true#understanding-authentication-flow-with-jamf-connect-and-filevault

In case you do set DisableFDEAutoLogin in macOS or the DenyLocal key in Jamf Connect Login, users will still need to authenticate twice after a reboot. This is however not related to the new feature discussed in this post, but purely related to the authentication flow to unlock FileVault.

One last thing I’d like to highlight here, in view of avoiding any confusion, is the fact that this new Passthrough Authentication in Jamf Connect Login has nothing to do with the similar functionality in Azure for hybrid tenants:

For hybrid environments with both an on-prem AD and an Azure AD linked together, you can have multiple configurations in view of the link between them and the way users are signing in:

  • Federation (ADFS)
  • Passthrough Authentication
  • Additional sync options like ‘Password Hash Sync’

Although the idea behind the Passthrough Authentication from Azure to on-prem AD, is similar to the way Jamf Connect Login now gets the credentials entered in the webapp, this is completely separate from the Passthrough Autentication between Azure and on-prem AD.

Passthrough Authentication in Jamf Connect Login does NOT require the Azure Tenant to have Passthrough Authentication to on-prem AD enabled.

Now, I’ve not personally tested this with an ADFS-federated tenant yet. However, I’ve seen reports that it surprisingly worked. Especially for environments with AllowCloudPasswordValidation enabled I do not see a reason why it would not work, but with pure federation I did not test yet either. However, in case you have WIA (Windows Integrated Authentication) configured in your environment, the passthrough auth in Jamf Connect Login does not work (expected).

That’s it! As always, if you liked the post, hit the like button, tell your friends about it and leave a comment down below!

Brgds,
TTG