Home Knowledge Base SecureW2 Documentation Jamf OAuth Validation API

Jamf OAuth Validation API

Introduction

SecureW2 now offers seamless integration with Jamf for various solutions, enhancing security and operational efficiency. A key addition is the lookup feature, which allows real-time verification of device status during processes such as certificate issuance or network authentication. This feature gives organizations flexible options tailored to their business requirements and security policies.

The following guide outlines the steps to configure the lookup feature within the network authentication flow. The lookup feature is also used during certificate issuance to verify that the device remains an active entity within the organization, serving as a critical verification step in issuing valid certificates.

Prerequisites

The following are the prerequisites for setting up lookup in Jamf during network authentication using a certificate:

  1. An active subscription to the Jamf Pro portal with administrator privileges.
  2. An active subscription to the JoinNow Platform with Org Admin privileges.

Configuring Jamf

The following are the high-level steps required to configure Jamf for dynamic lookup with JoinNow:

  1. Creating a Read-Only user
  2. Creating Client Credentials

Creating a Read-Only user

To create a read-only user in Jamf:

  1. From your Jamf Pro console, go to Settings > User accounts and groups.
  2. Click the + New button.
  3. On the Choose an Action step, select the Create Standard Account option and click Next.
  4. In the Account tab: 
    1. In the Username field, enter a username for the account. 
    2. From the Privilege Set drop-down list, select Custom. 
    3. Enter the other details, such as email address, password, and so on, in the respective fields.
    4. Select the Force user to change password at next login checkbox to require the user to reset their password the next time they sign in. Sign-in attempts may fail until the user’s password is reset. 
  5. Click the Privileges tab and select the READ checkbox for the following items. 
    1. Mobile Devices 
    2. Smart Computer Groups 
    3. Smart Mobile Device Groups 
    4. Static Computer Groups 
    5. Static Mobile Device Groups 
    6. Computers
  6. Click Save.

Creating Client Credentials

To configure client credentials, create API roles in JAMF and map the values in the JAMF Signal Source in the JoinNow Management Portal.

Creating new API Roles

  1. From your Jamf Pro console, go to Settings > System. 
  2. Click API roles and clients.
  3. Select the API Roles tab. 
  4. Click the + New button.
  5. In the Display name field, enter the name of the API role. 
  6. From the Privileges drop-down list, select the following privileges to be granted: 
    1. Read Mobile Devices 
    2. Read Computers 
    3. Create Webhooks 
    4. Delete Webhooks 
    5. Read Webhooks 
    6. Update Webhooks
  7. Click Save.

Creating new API Clients

  1. From your Jamf Pro console, go to Settings > System.
  2. Click API roles and clients.
  3. Select the API Clients tab.
  4. Click the + New button.
  5. In the Display name field, enter the name of the API Client.
  6. From the API roles drop-down list, select the API role created in the Creating new API Roles section to grant the privileges.
  7. In the Access token lifetime field, enter the token’s access duration in seconds.
  8. Click the Enable API client button to enable it.
  9. Click Save.
  10. Click the Generate client secret button to create the Client Credentials.
  11. Copy the client credentials and paste them into a TextPad.  

Configuring JoinNow Management Portal

The following are the high-level steps to configure JoinNow for Jamf Core Provider.

  1. Creating an Intermediate CA  
  2. Creating a Jamf Certificate Template
  3. Creating a Jamf Signal Source
  4. Configuring Policies

Creating an Intermediate CA for Jamf Integration

SecureW2 recommends the use of an Intermediate CA for Jamf lookup as a best practice for easy identification and management of your CAs. 

To create a new intermediate CA:

  1. Log in to the JoinNow Management Portal.
  2. Navigate to Dynamic PKI > Certificate Authorities. 
  3. Click Add Certificate Authority.
  4. In the Basic section, from the Generate CA For drop-down list, select the Device and User Authentication option to authenticate devices.
  5. From the Type drop-down list, select Intermediate CA. 
  6. From the Certificate Authority drop-down list, select the default Root CA that comes with your organization.
  7. For the Common Name field, enter a name. Recommended name format for easy identification – “myOrgName jamf Intermediate CA”.
  8. From the Key Size drop-down list, select 2048 for the CA certificate key pair. 
  9. From the Signature Algorithm drop-down list, select the signature algorithm for the certificate signing request. The option available is SHA-256.
  10. In the Validity Period field, enter the validity period for the Intermediate CA in terms of the number of years.
  11. In the Notifications section:
    1. From the Expiry Notification Frequency (in days) drop-down list, select the frequency interval for which a certificate expiration notification should be sent to users.
    2. Select the Notify user on successful Enrollment checkbox to notify users after a successful enrollment.
    3. If the RFC has a valid email address, the user will receive the certificate-issued or expired notification; otherwise, they will not.
  12. In the Revocation section:
    1. In the Revoke Certificate if unused for the field, select the number of days after which an unused certificate can be revoked.
      1. Since last usage – Select this checkbox to revoke the certificate after a specified number of days if it remains unused.
      2. Since certificate issuance – Select this checkbox to revoke the certificate after a specified number of days after it is issued.
    2. From the Reason Code drop-down list, select any one of the following reasons for which the certificate is revoked. 
      1. Certificate Hold
      2. AA Compromise
      3. Privilege Withdrawn
      4. Unspecified
  13. Click Save. This generates the new intermediate CA. 

Creating a Jamf Certificate Template for Jamf Lookup

A certificate template determines how information is encoded in the certificate to be issued by the Certificate Authority. It will consist of a list of certificate attributes and how the information must be encoded in the attribute values. This information is provided by the organization administrator using the JoinNow Management Portal.

To create a Certificate Template for Jamf lookup, perform the following steps:

    1. Navigate to Dynamic PKI > Certificate Authorities.
    2. Scroll to the Certificate Templates section and click Add Certificate Template.
    3. In the Basic section, enter the name of the certificate template in the Name field.
    4. In the Subject field, enter CN=${/device/identity:/csr/subject/commonname}. This fetches the common name configured in Jamf.
    5. In the Display Description field, enter a suitable description for the certificate template.
    6. In the Validity Period field, type the validity period of the certificate (based on the requirement).
    7. To override the Validity Period attribute, select the Override Validity Period checkbox and choose the end date from the date picker to set a hard-coded date as the expiry date of a certificate.
    8. From the Signature Algorithm drop-down list, select SHA-256 as the signature algorithm for the certificate signing request.
    9. In the SAN section:
      1. In the Other Name field, enter ${/device/clientId}
      2. In the RFC822 field, enter ${/device/clientId}
      3. In the DNS field, enter ${/device/buildModel}
      4. In the URI field, enter ${/device/userDescription}
    10.  In the Extended Key Usage section, from the Use Certificate For list, select Client Authentication.
    11. In the Notification section, select the Notify admin on certificate expiry checkbox to send certificate expiry email notifications to all Admins.
    12. Click Save.

Creating a Jamf Signal Source

A Signal Source must be set up in the JoinNow Management portal to integrate with the Jamf portal for device status lookup during the RADIUS Authentication.

To create a signal source, perform the following steps:

  1. Navigate to Integration Hub > Core Platforms.
  2. Click Add.
  3. In the Basic section, in the Name field, enter the name of the signal source.
  4. In the Description field, enter a suitable description for the signal source.
  5. From the Type drop-down list, select Jamf Pro.
  6. Click Save. 
  7. The page refreshes, and the Configuration, Attribute Mapping, and Groups tabs are displayed.
  8. Click the Configuration tab.
    1. From the Authentication Type drop-down list, select any one of the following options based on your business requirements. SecureW2 recommends using Client Credentials.
      1. Bearer Token – Authentication is done using Jamf user credentials.
      2. Client Credentials – Authentication is done using Client credentials.
    2. Bearer Token – Authentication is done using Jamf user credentials. 
      1. For Provider URL, enter your organization’s Jamf login URL.
      2. For the Username and Password fields, enter the Jamf credentials.
      3. From the Device Lookup via drop-down list, select the attribute to use for device lookup. The default is Serial Number.
      4. Click Validate to check your connection with Jamf.
    3. Client Credentials – Authentication is done using Client credentials
      1. For Provider URL, enter the Jamf URL of the organization.
      2. For the Client ID field, enter the client ID from Jamf. 
      3. For the Client Secret field, enter the client secret from Jamf.
      4. From the Device Lookup via drop-down list, select the attribute to use for device lookup. The default is Serial Number.
      5. Click Validate to check your connection with Jamf.
  9. Click the Attribute Mapping tab. The list of attributes supported by Jamf Pro Signal Source and SecureW2 is displayed in the Attribute Mapping section.
    1. From the Attribute Type drop-down list, select any one of the following options based on your business requirements.  
      1. Device 
      2. Custom
    2. To create custom attributes:
      1. Click the Add Custom Attributes link.
      2. In the Local Attribute field, enter the name to identify the attribute locally.
      3. From the Remote Attribute drop-down list, select any one of the attributes to be mapped to the Local attribute.
        1. Name
        2. Email
        3. User Defined
      4. If you select User Defined, enter a value to be mapped.
      5. Click Save to create the custom attribute with the appropriate mapping.
  10. Click the Groups tab.
    1. Click Add.
    2. In the Local Group field, enter the local group name.
    3. In the Remote Group field, enter the name of the group as configured in the Jamf Core Provider.
    4. Click Create.
  11. Click Update.

Configuring Policies

After the Signal Source creation, the following policies need to be configured in the JoinNow Management Portal to trigger the Lookup Operation during network authentication.

  1. Security Signal Source
  2. Policy Workflow
  3. Enrollment
  4. Network

Creating a Security Signal Source

The Security Signal Source can be mapped to the Jamf Signal Source created earlier for device lookup.

To create a Security Signal Source, perform the following steps:

  1. Navigate to Policy Management > Security Signal Sources.
  2.  Click Add Security Signal Source.
  3. In the Basic section, enter the name of the security signal source in the Name field.
  4. In the Display Description field, enter a suitable description for the security signal source.
  5. Lookup Purpose – Purpose of Account Lookup
    1. Certificate Issuance – To lookup the user/device account during Certificate Issuance.
    2. RADIUS Authentication – To lookup the user/device account during RADIUS Authentication.
  6. Click Save.
  7. The page refreshes, and the Conditions and Settings tabs are displayed.
  8. Click the Conditions tab.
  9. Under the Conditions section, from the Provider drop-down list, select the Core Provider used for authentication during the Certificate Issuance. This policy will be triggered if a certificate’s Core Provider is mentioned in the Conditions tab and that certificate has been sent for CloudRADIUS Authentication. If your organization is using only one Core Provider, then choosing ANY should work. Alternatively, you can create various lookup policies with Conditions mapping to each Core Provider that your Organization supports.
  10. From the Identity drop-down list, select an attribute to trigger conditions based on specific lookup requirements. The displayed attributes depend on the Lookup purpose selected earlier. The attributes are:
    1. Custom – Select this option to add custom lookup attributes for both Enrollment and RADIUS authentication during lookup, in addition to the listed attributes.
    2. CSR – Select a CSR attribute as the lookup attribute for Enrollment during lookup.
    3. Certificate – Select a certificate attribute as the lookup attribute for RADIUS authentication during lookup.
  11. Configure Regex to identify and group the entities in the Jamf Portal. The Lookup Operation can be applied to this selected group of entities.
  12. Select the Settings tab.
  13. Under the Settings tab, from the Provider drop-down list, select the Jamf signal source you created in the Creating a Jamf Signal Source section.
  14. From the Lookup Type drop-down list, select Device. 
  15. From the Identity drop-down list, select the options based on your business requirements.
    1. Custom – The Org Admin can select this option to add custom lookup attributes for both Enrollment and RADIUS authentication, in addition to the listed options, during device lookup.
    2. CSR – The Org Admin can select any CSR attribute as the lookup attribute for Enrollment during device lookup.
    3. Certificate – The Org Admin can select any certificate attribute as the lookup attribute for RADIUS authentication during device lookup.
  16. Select the Revoke On Failure checkbox to automatically revoke a certificate if an account lookup fails, if necessary.
  17. Click the Validate Configuration button to check if the lookup is valid.
  18. On the Validate Configuration pop-up window, in the Enter a valid identity field, enter the identity (device) to validate the lookup, and click Validate.
  19. After the successful validation, the associated attributes and groups of the Jamf Signal Source are displayed on the Lookup Details prompt. The admin can use this information to configure the network policies and verify the user’s validity.

    NOTE: When the Admin enters an invalid identity on the Validate Configuration pop-up window, the following error message is displayed: “Account lookup failed.” 
  20. Click Update.

Creating a Policy Workflow

The Cloud RADIUS Dynamic Policy Engine utilizes this policy to categorize devices based on the outcomes of their lookup operations, applying tailored Network Policies during authentication. For example, if a lookup operation identifies a device as inactive, the Policy Workflow can group these devices, allowing Cloud RADIUS to dynamically enforce Network Policies that restrict internet access for those devices.

  1. Navigate to Policy Management > Policy Workflows.
  2. Click Add Policy Workflow.
  3. In the Basic section, enter the name of the policy workflow in the Name field.
  4. In the Display Description field, enter a suitable description for the policy workflow.
  5. Click Save.
  6. The page refreshes, and the Conditions tab is displayed.
  7. Click the Conditions tab.
  8. From the Core Provider drop-down list, select the Signal Source created in the Creating a Jamf Signal Source section.
  9. Click Update.

Creating Enrollment Policy

You can now use the lookup before certificate issuance as a dynamic check. To trigger the lookup during certificate issuance, map the policy workflow created in the section Policy Workflow in the enrollment policy created below:

  1. Navigate to Policy Management > Enrollment.
  2. Click Add Enrollment Policy.
  3. In the Basic section, enter the name of the enrollment policy in the Name field.
  4. In the Display Description field, enter a suitable description for the enrollment policy.
  5. Click Save.
  6. The page refreshes, and the Conditions and Settings tabs are displayed.
  7. Click the Conditions tab.
  8. In the Conditions section, from the Policy Workflow list, select the role policy you created in the Creating a Policy Workflow section.
  9. From the Device Role list, select DEFAULT DEVICE ROLE POLICY 1.
  10. Select the Settings tab.
  11. In the Settings section, from the Use Certificate Authority drop-down list, select the intermediate CA you created in the Creating an Intermediate CA for Jamf Integration section.
  12. From the Use Certificate Template drop-down list, select the certificate template you created in the Creating a Jamf Certificate Template for Jamf Lookup section.
  13. For the other settings, retain the default values.
  14. Click Update.   

Configuring Network Policy

As with certificate issuance, you can use Lookup before RADIUS Authentication as a dynamic check. To trigger the lookup during the RADIUS Authentication, map the policy workflow created in the Policy Workflow section in the Network Policy created below:

  1. Navigate to Policy Management > Network.
  2. Add Network Policy.
  3. In the Basic section, enter the name of the network policy in the Name field.
  4. In the Display Description field, enter a suitable description for the network policy.
  5. Click Save.
  6. The page refreshes and displays the Conditions and Settings tabs.
  7. Click the Conditions tab.
  8. Select Match All or Match Any based on your requirement to set authentication criteria. In the case explained here, we are selecting Match All.
  9. Click + Add rule.
  10. Expand Identity and select the Policy Workflow option.
  11. Click Save.
  12. The Policy Workflow option appears under the Conditions tab.
  13. From the Policy Workflow Equals drop-down list, select the policy workflow you created in the Policy Workflow section. You can select multiple Policy Workflows to assign to a Network Policy.
  14. Select the Settings tab.
  15. From the Access drop-down list, select any one of the options to allow or deny authentication requests. The default value is “Allow”.
  16. To configure MFA, select the checkbox to enable MFA.
  17. From the Perform MFA Using drop-down list, select a Core Provider for MFA.
  18. Click Add Attribute.
    1. From the Dictionary drop-down list, select an option: Radius: IETF or Custom.
    2. From the Attribute drop-down list, select an option.
      1. Framed-Protocol
      2. Framed-IP-Address
      3. Framed-IP-NetMask
      4. Framed-Routing
      5. Filter-Id
      6. Framed-MTU
      7. Framed-Compression
      8. Reply-Message
      9. Framed-Route
      10. Framed-IPX-Network
      11. State
      12. Class
      13. Session-Timeout
      14. Tunnel-Type
      15. Tunnel-Medium-Type
      16. Tunnel-Private-Group-ID
      17. Framed-Pool
    3. In the Value field, enter the appropriate value for the attribute.
    4. Click Save.

      NOTE      : Repeat the process for all the attributes you want to send to the Policy Workflow.
  19. Click Update.

Data and Monitoring

After successful configuration, admins can verify RADIUS Authentication Success under Data and Monitoring > RADIUS Events. In case of Certificate Issuance, a message will be displayed for the device enrolled under Data and Monitoring > Enhanced Events. 

RADIUS Events

Enhanced Events

More JAMF Explainers
Reseller or MSP? Join our Partner Program