Configure a Device Level Mac SSO Extension Policy

When using an identity provider (IdP) other than JumpCloud, a SSO Extension policy uses Apple's Extensible Single Sign-On to allow users on MDM-managed macOS devices to seamlessly access their resources without requiring them to re-authenticate.

Prerequisites

• Supported on macOS 10.15 Catalina and later.
• MDM is configured for your org and the device is enrolled in MDM.
• You are not using JumpCloud as your IdP. See Get Started: Federated Authentication

Creating the Policy

To create a SSO Extension policy for Mac computers, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• Under Settings, configure the Extension Type:
  • Credential: via username and password (challenge and response authentication, like Kerberos)
  • Redirect: via identity provider URL; modern authentication methods like OIDC, OAuth and SAML. Instead of loading a login page, the OS will redirect the request to the extension
• Extension Identifier: Enter the bundle identifier of the app extension that will perform single-sign on. Find this identifier by inspecting the app's info.plist file.
• (Optional) Team Identifier: Enter the 10-digit alphanumeric string team identifier of the app extension that will perform single-sign on.
• When Extension Type is set to Credential, you will see options for:
  • Realm: Displayed only when Extension Type is set to Credential. Enter the capitalized realm name for the credential. This field is typically used for Kerberos extensions to identify the Kerberos realm. 
  • Hosts: Enter the domains names or host names of sites or applications that can be authenticated through the extension. These names must be unique across all SSO extension profiles installed on the device.
• When Extension Type is set to Redirect, you will see:
  • URLs: Specify the URL prefixes of identity providers on whose behalf the app extension will authenticate. Parameters and fragments are not permitted; URLs must begin with https:// or http:// and be unique across all SSO extension profiles installed on the device.
• Additional Settings: Specify one or more key-value pairs that you want to pass to the app extension to modify the app.
  • For example, department: engineering or disableLogging: true

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Devices tab. Select one or more devices whom you want to add this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.