Script Writing For Mac Image Usiign Jamf

  

You can configure Jamf Connect by setting preference keys.

  1. Jamf Pro
  2. Jamf Pro Software
  3. What Is Jamf Software

As per the similar post for macOS Catalina, we can block the macOS Big Sur app via Jamf Pro Restricted Software feature. For this, you can use the process name of “Install macOS Big Sur.app” and after the management framework is updated on a macOS device in scope it’ll have the block in place. Add the NetBoot server to Jamf Pro by doing the following: In the top-right corner of the page, click Settings. Click Server Infrastructure. Click Netboot Servers. Configure the settings on the pane, making sure to choose 'Use default image' from the NetBoot Image pop-up menu. Click Computers at the top of the page. Instead of using the built in Dock icon functionality in a policy, which forces the icon in the user's Dock, the script will utilize cocoaDialog or jamfHelper to prompt the client if they would like the icon for the just installed application in their Dock. Requirements for the script: Parameter 4 (Application Name only). If you use the JAMF Nation link above, look for the script by user emily. It is all that’s needed, provided the Xcode CLI tools are already installed. I have no idea why people love to complicate things so much in their scripts.

Preference keys allow for full manipulation of Jamf Connect Login’s features. You can set preferences with any of the following methods:

  • Use Jamf Connect Configuration to create and test a configuration profile.
    For more information, see Jamf Connect Configuration.

  • Manually create a configuration profile with a text editor.

  • Set preferences with the defaults write command.

Note: The defaults command will not show preferences set by an MDM solution.

Jamf Connect Login preference keys must be written in the following location:

Jamf Connect Login does not create this PLIST file. You must create it manually.

If using Jamf Pro, you must sign the configuration profile before uploading. For more information, see the Deploying Custom Configuration Profiles with Jamf Pro Knowledge Base article.

The following tables contain all the preference key-value pairs that can be set with Jamf Connect Login.

Note: Example key-values, where applicable, match the default Jamf Connect setting. Boolean key-values that are not configured default to false unless stated otherwise, and key-values that configure text show the default text in the app.

Required Settings

Keys

Description

Example

OIDCProvider

Specifies Microsoft Azure AD as your IdP.

<key>OIDCProvider</key>

<string>Azure</string>

OIDCClientID

The Application ID of the registered app in your IdP used to authenticate the user.

<key>OIDCClientID</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

OIDCROPGID

The Application ID of the registered app in you IdP used for authenticating the user's password via a resource owner password grant (ROPG) workflow. This value should should usually match the OIDCClientID preference key.

<key>OIDCROPGID</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

Account Creation Settings

Key

Description

Example

CreateAdminUser

If set to true, all users become local admins when created on the computer.

<key>CreateAdminUser</key>

<false/>

CreateVerifyPasswords

Determines if a keychain entry is created for Jamf Connect Verify.

<key>CreateVerifyPasswords</key>

<false/>

DemobilizeUsers

Determines if any existing Active Directory mobile accounts are 'demobilized', which is the process of converting a mobile account into a local account. Demobilization also removes the network authentication authority from the account.

Once demobilized, you can unbind the Mac from Active Directory.

Important: If you unbind from Active Directory before demobilization, demobilization may fail if a user's Active Directory password and IdP password do not match and Jamf Connect Login is configured to sync the passwords during account creation. Make sure you demobilize accounts before unbinding from Active Directory and that the Active Directory domain is reachable during account creation with Jamf Connect.

<key>DemobilizeUsers</key>

<false/>

DenyLocal

Determines if users can bypass network authentication and use the Local Auth button at the loginwindow.

If set to true, the Local Auth button is not available, and user must authenticate to their network.

If set to false, the Local Auth button is available, and users can choose to authenticate locally.

<key>DenyLocal</key>

<false/>

DenyLocalExcluded

Specifies which users can still locally authenticate if DenyLocal is set to true

<key>DenyLocalExcluded</key>

<array>

<string>user-one</string>

<string>user-two</string>

<string>user-three</string>

<string>user-four</string>

</array>

LicenseFile

The contents of a .jamfconnectlicense file encoded in Base64 data format.

Note: Maintaining your license key in a separate configuration profile provided by your account manager is recommended.

<key>LicenseFile</key>

<data>encoded-license-content</data>

LocalFallback

Used with DenyLocal to force authentication to the IdP first, but then fallback to local authentication if the IdP is unavailable.

<key>LocalFallback</key>

<false/>

Migrate

Allows local accounts to be migrated to network accounts.

This is typically used when the user account was already created on the system, but you want the accounts to have the same username and password as the user’s cloud identity.

Jamf Connect Login does this by forcing the user to sign in with their IdP, and then attempts to match the user with an existing local account. Consider the following user migration scenarios:

  • If a user's network username and password match a local username and password, the account is considered migrated. No additional steps are needed.

  • If a user's network username matches a local username but the passwords do not match, the user will be prompted to enter their current local password. Once successfully entered, Jamf Connect Login will use the current local password and the current network password to sync the account to the current network password.

  • If a user's network username does not match any local account, the user will be given the option to create or migrate a local account. To migrate an account, the user must provide the existing local password. At this point Jamf Connect Login will synchronize the password to the network password, and then add the network username as an alias to the local account. This way the user can sign in to the system as their network username.

Additionally, IdPs can migrate users from local accounts to accounts associated with network identity. With the Migrate and DenyLocal preference keys, all subsequent sign-ins will be authenticated to your IdP, and then the system verifies if the user record has an IdPUser attribute. If this attribute cannot be verified, the user will be asked to select a local account to associate with the user’s network account. If the local account shortname does not match the network shortname, the network name will be added as an alias to the account so the user will be able to use either one. This also keeps the home folder path and other elements of the user record the same.

Note: For every successful network authentication of a user, the user’s record will be updated with the “NetworkSignIn” attribute. If the user was only authenticated locally, this attribute will not be updated.

<key>Migrate</key>

<false/>

MigrateUsersHide

Specifies which local accounts are excluded from the migration pull-down menu

<key>MigrateUsersHide</key>

<array>

<string>admin</string>

<string>ladmin</string>

</array>

RightsTmpCache

When using the AuthUI rule, determines if the token cache is set to /tmp/cachedata

<key>RightsTmpCache</key>

<false/>

UIDTool

Specifies a path to a UID tool that allows you to set a local user account's UID to a custom value during account creation. This can be used to match a local user account's UID with a user's LDAP UID attribute. Your UID tool must be an executable script.

<key>UIDTool</key>

<string>/Users/Shared/UIDTool</string>

OpenID Connect Settings

Key

Description

Example

OIDCNewPassword

If set to true, this key prompts users to create a new password for their new local account.

If set to false, this key prompts users to re-enter their network password, which also becomes the local account password. This ensures a user's network and local password are synced during user creation.

<key>OIDCNewPassword</key>

<true/>

OIDCAdmin

Specifies which user groups become local admins during account creation. You can specify one user group as a string or multiple user groups in an array of strings.

Note: By default, Jamf Connect Login reads the 'groups' attribute in a user's ID token to determine if they become a local admin. To use a different attribute to determine user creation, see the OIDCAdminAttribute preference key.

<key>OIDCAdmin</key>

<string>role</string>

or

<key>OIDCAdmin</key>

<array>

<string>role-one</string>

<string>role-two</string>

<string>role-three</string>

<string>role-four</string>

</array>

OIDCAdminAttribute

Specifies what attribute stored in an ID token is used to determine if a user is created as a standard or admin local user. By default, Jamf Connect Login will read the 'groups' attribute for any values specified with the OIDCAdmin preference key.

<key>OIDCAdminAttribute</key>

<string>insert-attribute</string>

OIDCClientSecret

The client secret used by Jamf Connect Login and your IdP.

<key>OIDCClientSecret</key>

<string>insert-client-secret-here</string>

When set to true, Jamf Connect Login will use local authentication by default rather than cloud authentication, which ensures users can always log in without a network connection.

<key>OIDCDefaultLocal</key>

<false/>

OIDCIgnoreAdmin

When set to true, Jamf Connect Login will ignore any roles that exist in your IdP. This key ensures local user accounts maintain their current status as either an admin or standard account.

When set to false or unspecified, Jamf Connect Login will read the OIDCAdmin key for configured roles and will change a local user account status based on any roles in your IdP.

<key>OIDCIgnoreAdmin</key>

<false/>

OIDCRedirectURI

The redirect URI used by your Jamf Connect app in your IdP.

'https://127.0.0.1/jamfconnect' is recommended by default, but any URI value may be used as long as the configured value in IdP matches the value in your Jamf Connect Login configuration profile.

<key>OIDCRedirectURI</key>

<string>https://127.0.0.1/jamfconnect</string>

OIDCTenant

Specifies the Tenant ID for your organization that's used for authentication.

<key>OIDCTenant</key>

<string>c27d1b33-59b3-4ab2-a5c9-23jf0093</string>

OIDCDiscoveryURL

Your IdP's OpenID metadata document that stores OpenID configuration information. This value appears in the following format: 'https://domain.url.com/.well-known/openid-configuration'

Note: This key is required if the OIDCProvider key is set to 'Custom'.

<key>OIDCDiscoveryURL</key>

<string>https://identity-provider-example-address.com/.well-known/openid-configuration</string>

OIDCIgnoreCookies

Ignores any cookies stored by the loginwindow

<key>OIDCIgnoreCookies</key>

<false/>

OIDCScopes

Specifies custom scopes, which return additional claims in a user’s ID token during authorization. Standard scopes included openid, profile, and offline_access. This key should be configured as a string with space-separated values.

<key>OIDCScopes</key>

<string>openid profile</string>

OIDCIDTokenPath

Specifies the file path that can be used to store a user’s formatted ID token.

<key>OIDCIDTokenPath</key>

<string>/tmp/token</string>

OIDCIDTokenPathRaw

Specifies the file path that can be used to store a user’s raw ID token.

<key>OIDCIDTokenPathRaw</key>

<string>/tmp/token-raw</string>

Pluggable Authentication Module (PAM) Settings

Key

Description

Example

AuthUIOIDCProvider

Identity Provider (PAM)

Specifies the identity provider to use for authentication via the Pluggable Authentication Module (PAM)

<key>AuthUIOIDCProvider</key>

<string>insert-identity-provider</string>

AuthUIOIDCClientID

Client ID (PAM)

The client ID of the created Jamf Connect app in your identity provider used for authentication via PAM

<key>AuthUIOIDCClientID</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

AuthUIOIDCRedirectURI

Redirect URI (PAM)

The redirect URI used by the created Jamf Connect app in your identity provider

<key>AuthUIOIDCRedirectURI</key>

<string>https://127.0.0.1/jamfconnect</string>

AuthUIOIDCTenant

Tenant ID (PAM)

The tenant in your identity provider used for authentication via PAM

<key>AuthUIOIDCTenant</key>

<string>dev-123456</string>

AuthUIOIDCClientSecret

Client Secret (PAM)

The client secret of your Jamf Connect app in your IdP. This value is only known by Jamf Connect and your IdP.

<key>AuthUIOIDCClientSecret</key>

<string>9fcc52c7-ee36-4889-8517-lkjslkjoe23</string>

Messaging and Appearance Settings

Key

Description

Example

BackgroundImage

Background Image

Path to a locally stored image to use as a background for the login window

<key>BackgroundImage</key>

<string>/usr/local/shared/background.jpg</string>

BackgroundImageAlpha

Background Image Alpha Value

The alpha value of the vibrancy layer blur above the background image as an Int from 0-10, representing the alpha value in 10% increments (e.g., a value of 8 would configure the vibrancy layer blur to be 80% alpha)

Note: Target computers must be running macOS 10.13.x.

<key>BackgroundImageAlpha</key>

<integer>10</integer>

LoginLogo

Login Logo

Path to a locally stored image to use as a logo during password validation or local password creation

<key>LoginLogo</key>

<string>/usr/local/images/logo.png</string>

Help Settings

Key

Description

Example

AllowNetwork Selection

Allow Network Selection

When set to true, this preference key allows users to configure and confirm their network connection preferences from the login window. To access this feature when enabled, users can click Network Connection in the bottom-right corner of the login window.

Note: To ensure the security of computers, users cannot select an open Wi-Fi network at the login window.

<key>AllowNetworkSelection</key>

<false/>

HelpURL

Help URL

Specify a URL to display at the login window that directs user's to a resource for onboarding or enrollment help.

<key>HelpURL</key>

<string>yourcompany.help.com</string>

HelpURLLogo

Help Icon

Add a custom image to use as a clickable logo for the Help URL.

<key>HelpURLLogo</key>

<string>/usr/local/shared/helplogo.png</string>

LocalHelpFile

Backup Help File

A path to a local file that users can access by clicking the 'Help' button in the Jamf Connect Login window. This file is only displayed if the computer cannot connect to the internet and access the URL specified with the HelpURL key.

<key>LocalHelpFile</key>

<string>/usr/local/shared/JamfConnectHelp.pdf</string>

FileVaultSettings
If enabling FileVault on computers with Jamf Connect, see the Using FileVault with Jamf Connect Knowledge Base article.

Key

Description

Example

EnableFDE

Enable FileVault

If set to true, FileVault will be enabled for the first user that logs in to a computer.

<key>EnableFDE</key>

<false/>

EnableFDERecoveryKey

Save FileVault Recovery Key

If set to true, Jamf Connect will store the FileVault recovery key to /var/db/NoMADFDE unless otherwise specified.

<key>EnableFDERecoveryKey</key>

<false/>

EnableFDERecoveryKeyPath

Set Recovery Key Filepath

Specifies a custom file path for the FileVault recovery key

<key>EnableFDERecoveryKeyPath</key>

<string>/usr/local/filevault</string>

EULA Settings

Note: The EULA mechanism must be enabled before configuring EULA preferences. To add the EULA mechanism to Jamf Connect Login, see End User License Agreement.

Key

Description

Example

EULAPath

Audit Filepath

Specifies the file path to a directory where user’s end acceptance of a EULA is stored as log files.

<key>EULAPath</key>

<string>/usr/local/shared/EULA.txt</string>

EULAText

EULA Text

Text used for the EULA

<key>EULAText</key>

<string>Insert EULA text here</string>

EULATitle

EULA Text

Title of the EULA text

<key>EULATitle</key>

<string>User Agreement</string>

EULASubTitle

EULA Subtitle

Subtitle of the EULA text

<key>EULASubTitle</key

<string>Terms and Conditions</string>

Usiign

Script Settings

Note: The RunScript mechanism must be enabled before configuring script preferences. To add the RunScript mechanism to Jamf Connect Login, see Login Script.

Key

Description

Example

ScriptArgs

Script Arguments

The arguments used with a specified script run by the RunScript mechanism

<key>ScriptArgs</key>

<array>

<string>-v</string>

<string>-user</string>

</array>

ScriptPath

Script Path

Specifies the path to the script or other executable run by the RunScript mechanism. Only one script can be used with Jamf Connect Login at any time.

<key>ScriptPath</key>

<string>/usr/local/bin/login</string>

Hybrid Identity

Jamf Pro

These keys can be used to separate the authentication process completed via OpenID Connect from the password verification process completed by the Resource Owner Password Grant (ROPG), which is required to configure Jamf Connect with hybrid identity solutions.

For more information about configuring hybrid identities with Azure AD see the following Knowledge Base articles:

Key

Description

Example

ROPGProvider

Identity Provider (Hybrid ID)

Specifies where ROPG authentication will occur. Supported values are the following:

  • Custom

  • Azure_v2

Set this value to 'Custom' if using Azure AD with AD FS.

Set this value to 'Azure_v2' if you are using password hash synchronization or pass-through authentication, which allows Jamf Connect Login to use the Microsoft identity platform (v2.0) endpoints for authentication.

For more information about the Microsoft identity platform (v2.0), see the following documentation from Microsoft:
https://docs.microsoft.com/azure/active-directory/develop/azure-ad-endpoint-comparison

<key>ROPGProvider</key>

<string>Custom</string>

ROPGTenant

Tenant ID (Hybrid ID)

The tenant ID in your organization to use for ROPG authentication.

Note: This key is required if you set the ROPGProvider key to 'Azure_v2'.

<key>ROPGTenant</key>

<string>15e7196d-8bd5-4034-ae01-7bda4ad0c91e</string>

ROPGDiscoveryURL

Discovery URL (Hybrid ID)

Specifies your OpenID Connect discovery endpoint. If using AD FS, this value is your AD FS domain combined with the following: '/adfs/.well-known/openid-configuration'

Example: https://adfs.jamfconnect.com/adfs/.well-known/openid-configuration

Note: This key is required if you set the ROPGProvider key to 'Custom'.

<key>ROPGDiscoveryURL</key>

<string>https://adfs.jamfconnect.com/adfs/.well-known/openid-configuration</string>

ROPGRedirectURI

Redirect URI (Hybrid ID)

The redirect URI used by the created application in AD FS or Azure AD.

'https://127.0.0.1/jamfconnect' is recommended by default, but any valid URI value may be used as long as the configured value in Azure AD or AD FS matches the the value in your Jamf Connect Login configuration profile.

<key>ROPGRedirectURI</key>

<string>https://127.0.0.1/jamfconnect</string>

ROPGClientSecret

Client Secret (Hybrid ID)

The client secret of your Jamf Connect application. Consider the following scenarios when configuring client secrets:

  • If you are not using a client secret for ROPG authentication, set this value to 'NONE'.

  • If you are using the same client secret for both ROPG and the authorization grant with Azure AD, do not set this key. Jamf Connect Login will use the secret set with the OIDCClientSecret key for both authentication and password verification.

  • If using a different client secret for each authentication process, set both OIDCClientSecret and ROPGClientSecret to their respective values.

<key>ROPGClientSecret</key>

<string>your-client-secret</string>

Password Verification Success Codes

An array of strings that contain error codes from Azure during an ROPG password verification, which should be interpreted as successful by Jamf Connect.

If using multifactor authentication (MFA) with Azure as a part of the Enrollment Customization feature in Jamf Pro, you may need to use this key to ensure Jamf Connect does not incorrectly interpret an MFA response as an error.

For possible error codes that may need to be configured in your environment, see the following documentation from Microsoft: https://docs.microsoft.com/azure/active-directory/develop/reference-aadsts-error-codes

<key>ROPGSuccessCodes</key>

<array>

<string>AADSTS50012</string>

<string>AADSTS50131</string>Efi bootloader linux.

</array>


For related information about Jamf Connect Login, see the following sections of this guide:

  • Integrating with Microsoft Azure AD
    Learn how to integrate Jamf Connect Login with Microsoft Azure AD.

  • Jamf Connect Login User Experience
    Learn about the general user experience when using Jamf Connect Login.

Many scripts perform large and time-consuming processing operations. All too often, they do this invisibly; they simply run and the user has no idea how long processing will take. A more user-friendly approach is to provide progress information during script operation. At a basic level, this can be done by displaying periodic dialogs or notifications. See Displaying Dialogs and Alerts and Displaying Notifications. At a complex level, this can be done by designing a fully-custom interface that provides processing feedback.

AppleScript and JavaScript can also report progress graphically and textually. For script apps, this progress reporting takes the form of a dialog window containing a progress bar, descriptive text, and a Stop button. See Figure 30-1.

Script Writing For Mac Image Usiign Jamf

For scripts running in Script Editor, this progress reporting appears at the bottom of the script window. See Figure 30-2.

For scripts running from the systemwide script menu, this progress reporting appears in the menu bar, beneath a temporarily displayed gear icon. See Figure 30-3.

AppleScript has several language-level properties and JavaScript has a Progress object with properties that are used to produce this type of progress reporting. See Table 30-1.

Table 30-1Progress properties in AppleScript and JavaScript

AppleScript Property

JavaScript Property

Value Type

Description

progress total steps

Progress.totalUnitCount

Integer

Configures the total number of steps to be reported in the progress. For example, if the script will process 5 images, then the value for progress total steps would be 5.

progress completed steps

Progress.completedUnitCount

Integer

Configures the number of steps completed so far. For example, if the script has processed 3 of 5 images, then the value of progress completed steps would be 3.

progress description

Progress.description

Integer

Text to display when reporting progress. Use this is an opportunity to let the user know what’s happening. For example, it could indicate that images are being processed.

progress additional description

Progress.additionalDescription

Integer

Additional text to display when reporting progress. Use this is an opportunity to provide even more detailed information about what’s happening. For example, it could indicate the specific task being performed, and how much more processing is remaining.

Listing 30-1 and Listing 30-2 demonstrate how these properties can be used to provide progress information while processing a set of images.

APPLESCRIPT

Listing 30-1AppleScript: Display progress while processing images
  1. set theImages to choose file with prompt 'Please select some images to process:' of type {'public.image'} with multiple selections allowed
  2. -- Update the initial progress information
  3. set theImageCount to length of theImages
  4. set progress total steps to theImageCount
  5. set progress completed steps to 0
  6. set progress description to 'Processing Images..'
  7. set progress additional description to 'Preparing to process.'
  8. repeat with a from 1 to length of theImages
  9. -- Update the progress detail
  10. set progress additional description to 'Processing image ' & a & ' of ' & theImageCount
  11. -- Process the image
  12. -- Increment the progress
  13. set progress completed steps to a
  14. -- Pause for demonstration purposes, so progress can be seen
  15. delay 1
  16. end repeat
  17. -- Reset the progress information
  18. set progress total steps to 0
  19. set progress completed steps to 0
  20. set progress description to '
  21. set progress additional description to '

JAVASCRIPT

Listing 30-2JavaScript: Display progress while processing images
  1. var app = Application.currentApplication()
  2. app.includeStandardAdditions = true
  3. var images = app.chooseFile({
  4. withPrompt: 'Please select some images to process:',
  5. ofType: ['public.image'],
  6. multipleSelectionsAllowed: true
  7. })
  8. // Update the initial progress information
  9. var imageCount = images.length
  10. Progress.totalUnitCount = imageCount
  11. Progress.completedUnitCount = 0
  12. Progress.description = 'Processing Images..'
  13. Progress.additionalDescription = 'Preparing to process.'
  14. for (i = 0; i < imageCount; i++) {
  15. // Update the progress detail
  16. Progress.additionalDescription = 'Processing image ' + i + ' of ' + imageCount
  17. // Process the image
  18. // Increment the progress
  19. Progress.completedUnitCount = i
  20. // Pause for demonstration purposes, so progress can be seen
  21. delay(1)
  22. }
Script

Clicking the Stop button in a progress dialog results in a user cancelled error.

What is jamf software

For additional information, see Progress Reporting in AppleScript Release Notes and Progress in JavaScript for Automation Release Notes.

Jamf Pro Software

Note

What Is Jamf Software

There’s no need to call a dedicated command to actually display progress information. The act of setting values for the progress properties mentioned above automatically results in progress information being displayed in a dialog, Script Editor, or the menu bar.