{"id":111588,"date":"2024-07-01T11:48:55","date_gmt":"2024-07-01T15:48:55","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=111588"},"modified":"2024-07-03T12:09:16","modified_gmt":"2024-07-03T16:09:16","slug":"configure-an-sso-extension-policy-for-macos","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos","title":{"rendered":"Configure an SSO Extension Policy for macOS"},"content":{"rendered":"\n<p>When using an identity provider (IdP) other than JumpCloud, a SSO Extension policy uses Apple&#8217;s Extensible Single Sign-On to allow users on MDM-managed macOS devices to seamlessly access their resources without requiring them to re-authenticate.<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>The information used to supply the policy template should be available from your IdP\u2019s Knowledge Base, with instructions on how to properly configure the SSO Extension.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p><strong>Prerequisites<\/strong>:<\/p>\n\n\n\n<ul>\n<li>Supported on macOS 10.15+<\/li>\n\n\n\n<li>MDM is configured for your org and the device is enrolled in MDM<\/li>\n\n\n\n<li>You are not using JumpCloud as your IdP. See <a href=\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\" target=\"_blank\" rel=\"noreferrer noopener\">Get Started: Federated Authentication<\/a><\/li>\n<\/ul>\n\n\n\n<p><strong>To create a SSO Extension policy for macOS<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to <strong>DEVICE MANAGEMENT<\/strong> &gt; <strong>Policy Management<\/strong>.<\/li>\n\n\n\n<li>In the <strong>All<\/strong> tab, click (<strong>+<\/strong>).<\/li>\n\n\n\n<li>On the <strong>New Policy<\/strong> panel, select the <strong>macOS<\/strong> tab.<\/li>\n\n\n\n<li>Select the SSO Extension policy from the list, then click <strong>configure<\/strong>.<\/li>\n\n\n\n<li>Under <strong>Settings<\/strong>, configure the <strong>Extension Type<\/strong>:\n<ol class=\"is-lower-alpha\">\n<li><strong>Credential<\/strong>: via username and password (challenge and response authentication, like Kerberos)<\/li>\n\n\n\n<li><strong>Redirect<\/strong>: via identity provider URL; modern authentication methods like OIDC, OAuth and SAML. Instead of loading a login page, the OS will redirect the request to the extension<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li><strong>Extension Identifier<\/strong>: Enter the bundle identifier of the app extension that will perform single-sign on. Find this identifier by inspecting the app&#8217;s <strong>info.plist<\/strong> file.<\/li>\n\n\n\n<li>(Optional) <strong>Team Identifier:<\/strong> Enter the 10-digit alphanumeric string team identifier of the app extension that will perform single-sign on.<\/li>\n\n\n\n<li>When <strong>Extension Type<\/strong> is set to <strong>Credential<\/strong>, you will see options for:\n<ol class=\"is-lower-alpha\">\n<li><strong>Realm<\/strong>: Displayed only when <strong>Extension Type<\/strong> is set to <strong>Credential<\/strong>. Enter the capitalized realm name for the credential. This field is typically used for Kerberos extensions to identify the Kerberos realm.&nbsp;<\/li>\n\n\n\n<li><strong>Hosts<\/strong>: Enter the domains names or host names of sites or applications that can be authenticated through the extension. These names must be unique across all SSO extension profiles installed on the device.<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li>When <strong>Extension Type<\/strong> is set to <strong>Redirect<\/strong>, you will see:\n<ol class=\"is-lower-alpha\">\n<li><strong>URLs<\/strong>: Specify the URL prefixes of identity providers on whose behalf the app extension will authenticate. Parameters and fragments are not permitted; URLs must begin with https:\/\/ or http:\/\/ and be unique across all SSO extension profiles installed on the device.<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li><strong>Additional Settings<\/strong>: Specify one or more key-value pairs that you want to pass to the app extension to modify the app.\n<ol class=\"is-lower-alpha\">\n<li>For example, department: engineering or disableLogging: true<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li>(Optional) Select the <strong>Device Groups<\/strong> tab. Select one or more device groups where you\u2019ll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.<\/li>\n\n\n\n<li>(Optional) Select the <strong>Devices<\/strong> tab. Select one or more devices where you\u2019ll apply this policy.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>&nbsp;For this policy to take effect, you must specify a device or a device group.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"14\">\n<li>Click <strong>Save<\/strong>.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>When using an identity provider (IdP) other than JumpCloud, a SSO Extension policy uses Apple&#8217;s Extensible Single Sign-On to allow [&hellip;]<\/p>\n","protected":false},"author":206,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2925,2852,2862,3082],"support_tag":[],"coauthors":[2842],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Configure an SSO Extension Policy for macOS - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to configure an SSO Extension policy for macOS to leverage Apple&#039;s Extensible SSO when using an external identity provider.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configure an SSO Extension Policy for macOS\" \/>\n<meta property=\"og:description\" content=\"Learn how to configure an SSO Extension policy for macOS to leverage Apple&#039;s Extensible SSO when using an external identity provider.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-07-03T16:09:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"890\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"pamkellman\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos\",\"url\":\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos\",\"name\":\"Configure an SSO Extension Policy for macOS - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"datePublished\":\"2024-07-01T15:48:55+00:00\",\"dateModified\":\"2024-07-03T16:09:16+00:00\",\"description\":\"Learn how to configure an SSO Extension policy for macOS to leverage Apple's Extensible SSO when using an external identity provider.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Configure an SSO Extension Policy for macOS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Configure an SSO Extension Policy for macOS - JumpCloud","description":"Learn how to configure an SSO Extension policy for macOS to leverage Apple's Extensible SSO when using an external identity provider.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos","og_locale":"en_US","og_type":"article","og_title":"Configure an SSO Extension Policy for macOS","og_description":"Learn how to configure an SSO Extension policy for macOS to leverage Apple's Extensible SSO when using an external identity provider.","og_url":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos","og_site_name":"JumpCloud","article_modified_time":"2024-07-03T16:09:16+00:00","og_image":[{"width":890,"height":525,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes","Written by":"pamkellman"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos","url":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos","name":"Configure an SSO Extension Policy for macOS - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"datePublished":"2024-07-01T15:48:55+00:00","dateModified":"2024-07-03T16:09:16+00:00","description":"Learn how to configure an SSO Extension policy for macOS to leverage Apple's Extensible SSO when using an external identity provider.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/configure-an-sso-extension-policy-for-macos#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Configure an SSO Extension Policy for macOS"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/111588"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/206"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/111588\/revisions"}],"predecessor-version":[{"id":112494,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/111588\/revisions\/112494"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=111588"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=111588"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=111588"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=111588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}