> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Jamf Pro

Jamf Pro is comprehensive enterprise management software for the Apple platform to simplify IT management for Mac, iPad, iPhone and Apple TV (see <https://www.jamf.com/products/jamf-pro/>). You can protect access to Jamf Pro by integrating Jamf Pro with Identity as a Service. Once integrated, users can use single sign-on to log in to their Jamf Pro account through Identity as a Service.

note

This integration was tested using Identity as a Service version 5.13 and Jamf Pro version 10.26.1-t1606923553. Other versions of Jamf Pro may require integration and configuration steps that differ from those documented in this procedure. For other versions of Jamf Pro, use this procedure as a starting point for integrating Jamf Pro. In the event of other issues, contact <support@entrust.com> for assistance.

## Step 1: Add Jamf Pro to Identity as a Service

1. Log into your Identity as a Service administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications** **Lists** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **JamF Pro**. The **Add Jamf Pro** page appears.

6. Enter an **Application Name**.

7. Enter an **Application Description**.

8. Optional. Add a custom application logo.

   1. Click Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Upload icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
   4. If required, resize your image.
   5. Click **OK**.

9. Select the **Authentication Flow** that appears to users during login.

10. Click **Next**. The **General** page appears.

11. In the **Default Assertion Consumer Service URL** field, enter:

    `https://<mycompany>.jamfcloud.com/saml/SSO` where `<mycompany>` is your Jamf Pro account name.

12. In the **Service Provider Entity ID (Issuer)** field, enter:

    `https://<mycompany>.jamfcloud.com/saml/metadata` where `<mycompany>` is your Jamf Pro account name.

13. In the **Single Logout Service URL** field, enter:

    `https://<mycompany>.jamfcloud.com/saml/SingleLogout` where `<mycompany>` is your Jamf Pro account name.

14. Optional. Enter the **SAML Username Parameter Name** used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.

15. Enter the **SAML Session Timeout** to the time when the SAML Assertion times out. The maximum is 720 minutes.

16. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

17. From the **SAML NameID Attribute** drop-down list, select **Email**.

18. From the **SAML NameID Encoding Format** drop-down list, select **Unspecified**.

19. Select the **SAML Signing Certificate** from the drop-down list.

20. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Jamf Pro login page to log in.

21. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

22. Optional. Add **Alternative Assertion Consumer Service URLs**, as follows:

    1. Click **Add**.
    2. Enter a **Name**.
    3. Enter a URL **Value**.
    4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page.
    5. Optional. **Add an Application Logo**.
    6. Click **Add**.
    7. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

23. Leave the other fields at the default settings.

24. Click **Submit**.

## Step 2: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

## Step 3: Download the metadata file from Identity as a Service

1. In Identity as a Service, click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

2. Do one of the following:

   - Click Cloud Download icon next to the application you are integrating with Identity as a Service.
   - Click Ellipsis Vertical icon next to the application you are integrating with Identity as a Service and select **SAML IDP Metadata**.

   The **SAML Application Metadata** dialog box appears.

3. **Select the certificate to include in the SAML IDP Metadata file** from the drop-down list.

4. If applicable, **Select the domain to include in the SAML IDP Metadata** file from the drop-down list.

5. Enter the **Lifetime, in days, for the SAML IDP Metadata file**. The value must be between 2 and 730.

6. Do one of the following, as required:

   - Copy the **Public Endpoint** to paste into your SAML application being used Identity Provider authentication.
   - Click **Download**.

note

If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.

## Step 4: Upload the Identity as a Service metadata to Jamf Pro

1. Log in to your Jamf Pro account as an administrator.

2. Click the **Settings** button in the top-right. The Jamf Pro **System Settings** page appears.

3. Click the **Single Sign-On** icon. The **Single Sign-On** page appears.

4. Click **Edit**.

5. Select **Enable Single Sign-On Authenticator**.

6. From the **Identity Provider**s drop-down list, select **Other**.

7. In the **Other Provider** field, enter a name, for example, Entrust IDaaS.

8. In the **Entity ID** field, enter:

   `https://<mycompany>.jamfcloud.com/saml/metadata` where `<mycompany>` is your Jamf Pro account name.

9. From the **Identity Provider Metadata Source** drop-down list, select **Metadata File**.

10. Browse to select the file you downloaded in _Step 3: Download the metadata file from Identity as a Service_.

11. Under **User Mapping**, select **NameID**.

12. Under **Jamf Pro User Mapping**, select **Email**.

13. Ensure to select the following **Single Sign-On Options for Jamf Pro**:

    - Allow users to bypass the Single Sign-On authentication
    - Enable Single Sign-On for Self Service macOS
    - Enable Single Sign-On for User Initiated Enrollment

14. Configure Enrollment Access For **Any identity provider user**

15. Click **Save**.

## Step 5: Test the integration

**Testing Service Provider Login**

1. Open a Web browser and enter the URL for your Jamf Pro account. You are directed to Identity as a Service.
2. Enter your Jamf Pro account **User ID** and click **Next**.
3. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to Jamf Pro.

**Testing Identity as a Service redirect log in**

1. Log in to your Identity as a Service account.
2. Go to your **My Profile** page if you are not already there.
3. Under **Applications**, click **Jamf Pro**.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to Jamf Pro.