+8Hello,
We need to have ways to troubleshoot SSO connections. It is activated on my beta instance since it's available. I log in though SSO, yet, Compliance Benchmarks or Blueprints tell me I need to log in through SSO... This is not only annoying, there is absolutely no way or log to understand why this happens. I can only imagine issues when this rolls out at scale.
Who should I talk with to troubleshoot ?
Best answer by christiandooley
By the way, my OIDC connection was created as "Generic OIDC", so no Tenant was. documented, and I don't see a way to change it to Entra (apart from deleting / recreating ?).
Hey @astiephi please follow up if you are still having issues
+2Same for me, SSO was working yesterday on 11.14. Odd that it stopped working when the server upgraded.
I've disabled and enabled SSO - no change
I've disabled and enabled the cloud services connector - no change
New Browser - no change
Any advice would be appreciated as looking to fully test these new features before release
+9Hey @astiephi, I'm sorry to hear you're still facing issues. I will try to get back to you with some specific steps to take in a couple of hours.
@JamesE, would you mind sharing what has stopped working after upgrade? Are you no longer able to log into Jamf Pro using Admin SSO? When you go to Jamf Pro URL do you see a login screen with just the username field or are yo seeing both username and password fields? Or are you able to log in but no longer have access to Compliance Benchmarks or Blueprints?
Thank you!
+2@lukasz_slodziak For me i can still login with SSO so its still linked but the compliance tab stopped working and i cant access the new blueprints tab
+9Could you please collect the following data and forward it to beta@jamf.com citing my name?
Thank you!
+8Could you please collect the following data and forward it to beta@jamf.com citing my name?
Thank you!
Just sent over !
+5Hey @JamesE @astiephi I have a few things we can validate:
1 - Open up browser console (right click > inspect) > click network tab
2 - find `auth` (if it doesn't show up, reload page) > click > click on "Response" tab > scroll to bottom and see "authenticationType"
Verify this is OIDC or OIDC_WITH_SAML
It probably is but just doing a sanity check before stepping into the next troubleshooting step :)
3 - in network tab, find session-tokens request > click on it > click on "Response" tab
Do we see both "accessToken" & "idToken" populated?
4 - navigate to https://yourjamfprourl.jamfcloud.com/api/doc
5 - place admin credentials in the authentication to grab a token
6 - scroll down to `CSA` > expand > click on GET /v1/csa/tenant-id > try it out > execute
Does this return us a tenant-id?
7 - in CSA swagger now choose GET /v1/csa/token > try it out > execute
Does this return us a tenant-id?
Let me know, thanks!
+8Hey @JamesE @astiephi I have a few things we can validate:
1 - Open up browser console (right click > inspect) > click network tab
2 - find `auth` (if it doesn't show up, reload page) > click > click on "Response" tab > scroll to bottom and see "authenticationType"
Verify this is OIDC or OIDC_WITH_SAML
It probably is but just doing a sanity check before stepping into the next troubleshooting step :)
3 - in network tab, find session-tokens request > click on it > click on "Response" tab
Do we see both "accessToken" & "idToken" populated?
4 - navigate to https://yourjamfprourl.jamfcloud.com/api/doc
5 - place admin credentials in the authentication to grab a token
6 - scroll down to `CSA` > expand > click on GET /v1/csa/tenant-id > try it out > execute
Does this return us a tenant-id?
7 - in CSA swagger now choose GET /v1/csa/token > try it out > execute
Does this return us a tenant-id?
Let me know, thanks!
so... yes, it is OIDC in my case and I get no tenant, seems we are on something there.
"tenantId": null
+8so... yes, it is OIDC in my case and I get no tenant, seems we are on something there.
"tenantId": null
By the way, my OIDC connection was created as "Generic OIDC", so no Tenant was. documented, and I don't see a way to change it to Entra (apart from deleting / recreating ?).
+5By the way, my OIDC connection was created as "Generic OIDC", so no Tenant was. documented, and I don't see a way to change it to Entra (apart from deleting / recreating ?).
Hey @astiephi thanks for the response. Can you email beta@jamf.com your jamf pro URL and mention its "contact Christian D" and I will get the process fired off to address the issue.
+10Jamf Support haven't been able to get Jamf SSO working with our Entra domain. You email addresses are in a different DNS domain and dont match our account names/UPN so everything just breaks. They don't seen to want to fix it which means we'll not be able to use any of the new features comping to Jamf Pro like Compliance Benchmarks which I'm extremely annoyed about.
+5By the way, my OIDC connection was created as "Generic OIDC", so no Tenant was. documented, and I don't see a way to change it to Entra (apart from deleting / recreating ?).
Hey @astiephi please follow up if you are still having issues
+10Jamf Support haven't been able to get Jamf SSO working with our Entra domain. You email addresses are in a different DNS domain and dont match our account names/UPN so everything just breaks. They don't seen to want to fix it which means we'll not be able to use any of the new features comping to Jamf Pro like Compliance Benchmarks which I'm extremely annoyed about.
Actually we were able to finally solve the issue ourselves this morning, so its working now and I can finally try out the Compliance Benchmarks
+8Hey @astiephi please follow up if you are still having issues
Hey I don't know what kind of magic you applied, but it just works now ! Is that instance related or a general issue ?
+5Hey I don't know what kind of magic you applied, but it just works now ! Is that instance related or a general issue ?
Hey @astiephi thanks for the follow up! I'm happy we got you in working order. Its an issue we've seen more frequently in beta environments, its hard to distinguish if its specific to your instance or some behind the scenes things happening over here at Jamf. When we see the issue, we have a workflow internally that gets these situations back up and running once we diagnose the root cause as a missing tenant-id.
Happy Blueprints & Compliance Benchmark testing :)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.