Blank White Box Appears When New Okta Users Sign in via Jamf Connect Before MFA Enrollment

[cduran]

Hello Jamf Nation,

I’m experiencing an issue where new users signing into Jamf Connect using Okta authentication encounter a blank white box with a “Done” button instead of being guided through the MFA enrollment process.

Issue Details:
• This only happens for new Okta accounts that have not yet configured MFA.
• Existing users with MFA already set up can log in successfully without any issues.
• The Jamf Connect login window recognizes the new user but doesn’t properly handle the Okta MFA enrollment flow.
• The expected behavior would be for the user to be redirected to set up MFA, but instead, they get stuck with a blank screen.

Current Jamf Connect Setup:
• OIDC Authentication with Okta
• OIDCAllowMFA is enabled
• DenyLocal = True (Enforcing cloud login when online)
• LocalFallback = True (Allowing cached logins when offline)
• OIDCEmbeddedWebView = True

Troubleshooting Steps Taken:
• Confirmed that Okta policies require MFA enrollment for new users.
• Checked Jamf Connect logs (log stream --predicate 'subsystem == "com.jamf.connect"'), but no clear errors related to MFA setup appear.
• Tested setting OIDCEmbeddedWebView = False, but macOS does not allow launching a full browser pre-login.
• Users can complete MFA setup in a browser (Okta portal), and after that, Jamf Connect login works fine.

Questions:
1. Is there a way to allow Jamf Connect to properly handle the Okta MFA setup flow during first login?
2. Can Jamf Connect be configured to detect when MFA is required and instruct users to complete it in a browser before login?
3. Has anyone else encountered this issue, and if so, what workarounds have worked for you?

Thanks in advance for any insights! 🚀

We are using Jamf Connect version 2.44.0 this is happening on all OS versions we are currently using. 

[cduran]

This is the Plist we are using if this helps make sense of it all:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <!-- General Settings --> <key>AllowNetworkSelection</key> <true/> <key>AuthServer</key> <string>xxxxxx.okta.com</string> <key>CreateAdminUser</key> <true/> <key>CreateJamfConnectPassword</key> <true/> <key>DenyLocal</key> <true/> <key>DenyLocalExcluded</key> <array> <string>CSAdmin</string> </array> <key>OIDCDefaultLocal</key> <false/> <key>DisableFDEAutoLogin</key> <true/> <key>LocalFallback</key> <true/> <key>Migrate</key> <false/> <key>OIDCIgnoreAdmin</key> <true/> <key>OIDCNewPassword</key> <false/> <!-- OIDC (OpenID Connect) Settings --> <key>OIDCProvider</key> <string>Okta</string> <key>OIDCClientID</key> <string>xxxxxxxxx</string> <key>OIDCDiscoveryURL</key> <string>https://xxxx.okta.com</string> <key>OIDCAllowMFA</key> <true/> <key>OIDCAuthMethod</key> <string>POST</string> <key>OIDCIgnoreCookies</key> <true/> <key>OIDCRedirectURI</key> <string>https://127.0.0.1/jamfconnect</string> <key>OIDCUseWebView</key> <false/> <!-- Password Change URL --> <key>ChangePasswordURL</key> <string>https://account.activedirectory.windowsazure.com/ChangePassword.aspx</string> </dict> </plist>

[iternest]

I have the same issue

[mikevandelinder]

@cduran @iternest we may have a product issue similar to the experiences you've described, PI134272. If you want to open a support case we can keep you all updated as work progresses. Thanks!

[kprimm]

Hello,
Is this issue being reported for all versions of Jamf Connect?

[Cats-Team]

I tested it from Jamf Connect v2.33 to v2.45; issue happened to all 3 version of Jamf Connect for me.

Temp workaround I am using is changing the Jamf Connect Configuration Profile to have the HelpUrl set to your OKTA domain (https://support.okta.com/help/s/article/blank-page-in-jamf-connect-embedded-browser-during-mfa-regis...)

<key>HelpURL</key>
<string>https://domain.okta.com/</string>

[Cats-Team]

Woops, I meant v2.43 to v2.45

[kprimm]

@mikevandelinder Hello,
Is this issue being reported for all versions of Jamf Connect?

[mikevandelinder]

@kprimm correct, this issue does not appear to be dependent on specific versions of Connect

[Pei_Lin]

Okta put out a notice that they're aware of the issue, at least for compatibility with Jamf. The article "Blank Page in JAMF Connect Embedded Browser during MFA Registration" in the Okta Help Center provides two workarounds. (Linked below.) 

Link: https://support.okta.com/help/s/article/blank-page-in-jamf-connect-embedded-browser-during-mfa-regis...

[mikevandelinder]

Thank you all for your reports on the issue you've had with Okta MFA registration workflows during device login. Connect 2.45.1 was released today to resolve the scenario where the user would only see a blank screen. Updating to this release of Connect should resolve the issue without having to change any configuration in Jamf Connect or Okta. 

• https://learn.jamf.com/en-US/bundle/jamf-connect-release-notes/page/Jamf_Connect_macOS_Release_Notes...

That being said, for customers who have migrated to Okta Identity Engine and have their provider in Connect set to Okta, we recommend updating your Connect configuration to set your provider to Okta Identity Engine or Okta OIDC. More on that configuration can be learned here: https://learn.jamf.com/en-US/bundle/jamf-connect-documentation-current/page/Configuring_Okta_Identit...