Hey Everyone,
I have been battling this issue for quite some time and have done rigorous testing but have sincerely hit a wall with this issue. My organization is prepping to remove Administrator access from all users on our macOS systems, this requires them all to be converted to a Standard user. (We have a "MakeMeAnAdmin" script in place in JSS we plan to utilize)
MacOS: 14.3.1
Jamf Connect: 2.32.0
We use Jamf Connect with Azure/EntraID so users can authenticate on login, we have the app roles setup for the app registration in Azure with two groups, MacUserAdmin-Entra & MacUserStandard-Entra with the correct roles tied to each (Administrator & Standard)
The Problem:
Whenever a user is moved into the group tied to the STANDARD role in Azure and attempts to login to Jamf Connect on one of our Macs they can enter the O365 email, PW, verify 2FA, but then hit a "Yellow Exclamation Point" box with simply an "Okay" button. Once you click "Okay" you are kicked back to the Jamf Connect login within 10 seconds or so.
If a user is in the ADMINISTRATOR group tied to that role or switched back from the STANDARD they can login just fine and have those administrative privileges. It just seems Jamf Connect hates users in the group tied to the Standard role for some reason.
I can login as another local admin account (bypass Jamf Connect and use local login as another user) and see that the user in fact was converted to Standard via the System Settings Users & Groups section when moved into the group tied to the Standard role but cannot log in.
I tried various configurations for the Jamf Connect Login test profile to try and remediate this issue. I used the Jamf Connect Configuration.app included in the DMG with the latest version of Jamf Connect 2.32.0. I even made one from scratch but ran into more issues to went back to my original and made some edits, even scraping most things away but the issue persisted. Here is my current configuration profile for Jamf Connect Login (excluding some private info) that currently works for all folks to login as an Administrator but fails when they are in the STANDARD group:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AllowNetworkSelection</key>
<true/>
<key>BackgroundImage</key>
<string>/usr/local/jamf/bin/XXXXXX.jpg</string>
<key>CreateJamfConnectPassword</key>
<true/>
<key>DemobilizeUsers</key>
<true/>
<key>DenyLocal</key>
<true/>
<key>DenyLocalExcluded</key>
<array>
<string>XXXXXXXXXXX</string>
<string>XXXXXXXXXXX</string>
</array>
<key>EnableFDE</key>
<true/>
<key>LocalFallback</key>
<true/>
<key>LoginLogo</key>
<string>/usr/local/jamfconnect/logo.png</string>
<key>LoginWindowMessage</key>
<string>If you need help please submit a ticket via the Support PortalX</string>
<key>Migrate</key>
<true/>
<key>MigrateUsersHide</key>
<array>
<string>XXX</string>
<string>XXX</string>
</array>
<key>OIDCAdmin</key>
<array>
<string>Administrator</string>
</array>
<key>OIDCAdminAttribute</key>
<string>roles</string>
<key>OIDCClientID</key>
<string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string>
<key>OIDCNewPassword</key>
<false/>
<key>OIDCProvider</key>
<string>EntraID</string>
<key>OIDCROPGID</key>
<string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string>
<key>OIDCRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>
<key>OIDCTenant</key>
<string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string>
<key>ROPGProvider</key>
<string>Azure_v2</string>
<key>ROPGRedirectURI</key>
<string>https://127.0.0.1/jamfconnect</string>
<key>ROPGTenant</key>
<string>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</string>
<key>OIDCUsePassthroughAuth</key>
<true/>
</dict>
</plist>I confirmed in the Jamf Connect Configuration.app that the above works via the OIDC test and gives me a token for the test user when in the Administrator or Standard group!
Another thing I tried to ensure it was not Jamf Connect Menu related was unscoping that profile entirely from the test machine and attempting sign in as a test user in the Standard group but that fixed nothing, same yellow exclamation mark.
Next, I moved the user back into the Administrator group and signed in as normal. I pushed a policy with a script to demote the user to Standard and it did. Then when restarting I added the user back to the group in Azure tied to Standard user and the same thing! No progress!
Now I am stuck, not sure where to go from here. Only things I could find related to this on this forum or the MacAdmins slack channel was something related to Jamf Helper (which I believe we do not utilize anywhere) or Swift but unsure how to "downgrade" that and if thats even the cause!
Looking forward to seeing if anyone else has ran into this or can pick out my issue! Questions? Ask away!
Thank You,
Paul