Adobe CC 2019 User Sign-Ins

[metalfoot77]

I wanted to start a thread to get a discussion going about how my fellow Higher Ed jamfers plan to deal with Adobe's change to licensing in CC 2019. We currently operate with an enterprise license and install all the CC apps in a bundle to our computer labs. In the past this was done with the CC packager and a serializer. Adobe has since made that obsolete in favor of User based licensing.

So... we are now faced with the issue of ensuring that a user, after signing off of a machine, also gets signed out of any CC apps they had running. Thus making sure their that the next potential user is good to go.

I'm curious if anyone is attempting a sort of "log off" script for Adobe CC apps or how the community in planning on handling these new Adobe bombshells.

[AlanSmith]

We too are on the Enterprise License and this has created much discussion over the past 6 months. Thankfully our serial number will not expire until Feb 2020. So for us we have made the decision to stick with Adobe CC 2018 and continue to use serialised licensing until Adobe release their Lab Licensing model in first quarter 2019.

We will look at updating to Adobe CC 2019 once they have provided a solution that will work for our labs and other multi-user machines.

[grecopj]

Adobe is having a webinar on Dec 11th & 12th that will outline the new licensing program. They should be addressing device based licensing and enterprise customers.

https://edu.adobeeventsonline.com/Webinars/2018/MigrationWorkshop/index.php?source=151

Hope this gets implemented soon. We are running into issues with students upgrading and the labs are not.

[metalfoot77]

Thanks @AlanSmith for your reply. We unfortunately are in a situation where our students have access to the 2019 versions at home and are saving projects in that version then coming to campus and not being able to use our 2018 versions in the labs. It has become quite pervasive and sounds like @grecopj is having the same issues as well. Thanks for your replies.

[jhuls]

Same boat here. We're staying with 2018 until Adobe gets things figured out. Also, since we use the same policy to install for both labs and offices, we're withholding 2019 from staff and faculty as well for now. Our plan is to tie into Adobe's system so that hopefully we can use AD groups to manage who should be getting named licensing and the people who handle that are booked solid on other projects for a few months. Due to certain influences we might move forward with manually updating who gets named licenses but for now they're on hold as well.

[metalfoot77]

I feel like I have a good handle on what to do at this point now. I have packaged the 2019 suite from the new admin console downloaded it and moved into Jamf Admin. Once I figure out how to uninstall (in a clean manner) the older 2018 suite from my machines in jamf, then I will be good to move forward. We are just going to instruct users that they need to sign into the adobe apps when they launch them with their federated logins.

The part that really has us stumped is when a user logs in to Adobe products and then logs off the computer, it keeps them logged in. We need some way via jamf off forcing a log off of the CC apps when a user logs off the machine. This is the big sticking point for us at this point (although I'm fully prepared for more sticking points).

[WellsJtech]

I too was frustrated with the way Adobe 2019 was moving with all named licensed installs. Then I called Adobe Support and expressed my concern enough that the guy ended up telling me that the webinar that I was invited to in December will be explaining the Multi-User Packages that we will be able to build in Q1 2019. He told me that it will be basically a pre-serialized package that you can build in the Admin Console. Build it and deploy. No serialization needed. But it will work in the same manner as serialized; any user logs in, opens up the Adobe Product and uses it without having to sign in to Adobe.

[joshjohnson]

We recently moved to named user licenses from our device license and so far so good. Adobe has published a few resources about making the change.

https://edu.adobeeventsonline.com/cc/Resources/user-deployment/
https://edu.adobeeventsonline.com/cc/Resources/deployment-assets/Named%20User%20Deployment/K-12/Device%20to%20Named%20Conversion%20Guide.pdf?pdf=Device-to-Named-Conversion-Guide

When deploying the desktop app (required for user login) there are options to disable the apps panel and file syncing allowing students to login to access their named user license but not install additional apps or run updates which is ideal for a lab environment. I wouldn't worry about logging the user out. If they try to login and are already signed in on two machines, they will see an option to sign out from previously signed in machines to free up their license.

[jcline]

We are doing this in our high schools but we bound the labs to AD. Then when a new user signs in it makes a new profile and they sign in with their username. We have a script to rebind for when binding does it's thing.

[jhuls]

So, did anyone watch the webinar that Adobe did today for this situation?

I was registered for it but ran into issues with Adobe Connect telling me either that I needed to close and reopen it(several times) or that it was an old version(it was downloaded from Adobe right at that time) and then once I got past that ridiculousness I got a message that they were over the user limit for the meeting. Not a happy camper. I'd like to see if the webinar can be viewed since I was unable to participate.

[jkaigler]

They are supposed to make the recording available. Hope it's better than the live broadcast, audio was choppy. Here are a couple of links they made available:

https://spark.adobe.com/page/P2Pp0UfrueMuj/

https://landing.adobe.com/dam/uploads/2018/na/edu_shared_device_customer_faq_etla_vip_3dec2018.pdf

[kevin5495]

Today's webinar was a bust. I left after 20 minutes of bumbling, they were about to give up. I was able to get the handouts though. These are for Higher Ed ETLA customers. The FAQ applies to VIP customers too.

FAQ
https://landing.adobe.com/dam/uploads/2018/na/edu_shared_device_customer_faq_etla_vip_3dec2018.pdf

Creative Cloud in Lab Environments https://spark.adobe.com/page/P2Pp0UfrueMuj/

Kevin

[Brad_G]

We were able to get in, but as others have said a half hour of them trying to get the presentation to work and then choppy audio. It sounded like they had another session (not sure if it was a repeat or the recording they were doing) that was to play @ 7PM central time tonight.

They mentioned also sending out a link to the recording.

True to Adobe form this appears (from what I gathered) to make some things more inconvenient for both us as admins along with our student users.

[mconners]

Hello All, this is a frustrating subject of mine. Today at 12:30 PM, I get to meet with our art faculty to inform them we won't have CC 2019 installed over the winter break. Typically we run about 2-5 months behind new deployments. CC 2019 and the introduction of shared device licensing along with named user deployments by Adobe is a HUGE bust!

If we even give Adobe credit for having a solution, we have a bigger problem. Our current license is only used for volume licensing which died with CC 2018. For us to even move on with shared device licensing, we would have to have a new license. To get this new license, we would then also have to renew our contract with Adobe. We are 1 of 16 colleges in the Wisconsin Technical College System (WTCS) consortium and until ALL of the colleges agree to new terms with Adobe, we can't move forward. What makes matters worse is we have no idea what the costs will look like for all of us.

At this point, I can't promise the art programs any time line. I have told one person that we may not even have this in time for the fall semester of 2019. This is a massive problem and for some reason, Adobe doesn't get it. They are seemingly changing the rules without us knowing.

Ideally, I would love for them to tell us we can use our existing license number with shared device licensing, but I won't know that until mid week when we have a conference call with our Adobe higher ed rep. We will see, but I am not optimistic at all on Adobe.

[Chris_Hafner]

We're a small edu and have always made optional licensing available for our students, via self-service, through the myriad ways Adobe has required us to in the past. This change is a rather large and potentially costly issue as we currently buy more than enough licenses for the users that want it, but not enough for the whole body. Mostly, I'm worried about the overhead needed to make sure that we recover unused licenses/logins so that we can move them on to folks that will use the software. No different than the last dance, just a new tune I suppose. How long is adobe going to keep playing this silly licensing game? Ugh...

[metalfoot77]

@joshjohnson I think the problem I'm trying to potentially avoid is having a user log into an Adobe product. Then forget to sign-out when they leave or log out of the computer. Then the next user comes along and signs in and never gets prompted to sign into an Adobe product because the previous login from the other user is still logged in. I'd love to be able to make sure that when a user logs out of the machine that it also logs them out of any Adobe products as well.

[georgecm12]

@mconners I'm a little confused by your comments "Our current license is only used for volume licensing which died with CC 2018. For us to even move on with shared device licensing, we would have to have a new license. To get this new license, we would then also have to renew our contract with Adobe."

As far as I understand, if your institution is already under contract with Adobe (either ETLA or VIP), you can begin moving your faculty and staff clients over to the new licensing immediately, and your lab/classroom machines over as soon as the Shared Device licensing is available (Q1 2019). I'm fairly certain that there is no need to "re-up" on your contract to do so, unless your contract is due to expire imminently or has expired.

[mconners]

Sorry @georgecm12 you are correct. Our current license will not expire anytime soon and the new shared device licensing will allow us to use a single number until our current contract expires. Our (my) worry is we get this setup and working only to find out the college can't afford a renewal with Adobe and this cause a cascading of events here at the college. Time will tell how this plays out, but there is a lot of FUD (fear, uncertainty and doubt) floating around when it comes to Adobe. So in a sense, CC 2018 is the only known quantity at this point for us.

[georgecm12]

To be fair, though, if you can't afford a renewal with Adobe - wouldn't that cause basically the same sorts of issues, whether your computers are using the old serial number or the new Named User License and/or Shared Device License? Once your contract expires, you'd have to discontinue your use of Adobe products, or re-up, regardless of what application licensing methodology you use.

The biggest difference between the serial number and Named User License/Shared Device License is the need to have the Admin Console setup for your institution to assign licenses to users/groups. In other words, they're moving to a licensing server, similar to many other applications your institution may already be using. The main difference is that the licensing server is cloud based vs. on-prem.

[jhuls]

Has Adobe released a recording of the events that took place on the 5th yet?

[Chris_Hafner]

@georgecm12 For those of us using device licensing, it's a big change. They hosted the licensing server for this anyways, but it allowed our users to just grab a license if they needed it, via Self-Service. It is totally legit and registered with Adobe, but people didn't need to come to seek approval from a department or IT. This also meant that we didn't need to buy an entire site license. Total win-win! Now, we're hoping that Adobe realizes what this will do in an edu environment, or shared lab space and come up with another solution. There's mention of this above. One thing I can say is that I'm NOT buying a site license again unless they really drop the price. It's a HUGE waste when only 1/6th of our user population needs one of their products.

[taugust04]

Just in case people haven't had a chance to read through Adobe's documentation yet - in response to the webinar and the upcoming changes in 2019, we recently finished setting up everything needed to provision named user licenses, and in the future, shared user licenses this week. This included the following tasks:

• Claim our domain using a DNS text record generated by the Adobe.
• Configure SSO by linking it to our ADFS server so we can provided federated user account for Adobe logins.
• Linking our domain to our identity setup.
• Provisioning a virtual machine that will be running Adobe's User Sync Tool.
• Creating Adobe User Groups linked to products that can be licensed to our users, and then creating correlating groups in Active Directory.
• Configuring the Adobe User Sync Tool to login via LDAP, look at specific groups in Active Directory, and then add licenses to products based on Active Directory groups.
• Configuring a scheduled task so the sync runs a couple of times a day to catch any changes to user accounts automatically.

We've already done some basic testing and the the user sync tool does work. When we add and remove users from specific groups in AD their license entitlements are added or removed as needed.

After looking at Adobe's webinar materials regarding shared user licensing, when that option becomes available, our initial strategy will probably be to allocate the majority of our Adobe licenses as shared device licenses, and then provision users who need access to Creative Cloud with the "free" Adobe Spark license. That would then provide a similar level of access as users receive now in our device license setup, as we don't provide access to the cloud storage or the other Adobe features with CC 2018 and earlier. When our renewal comes up we'll most likely adjust that strategy to align with what best suits our needs for access to the cloud related services and apps that are provided with Adobe CC 2019 and named user licenses.

Additional resources:

Adobe SSO/Identity Setup:
https://helpx.adobe.com/enterprise/using/set-up-identity.html

Step-by-Step ADFS SSO Setup with Adobe Admin Console:
https://helpx.adobe.com/enterprise/kb/configure-microsoft-ad-fs-with-sso.html

Adobe User Sync Tool - Primary Documentation:
https://helpx.adobe.com/enterprise/using/user-sync.html

Adobe User Sync Tool - Additional/Advanced Documentation:
https://adobe-apiplatform.github.io/user-sync.py/en/

Shared License Resources:
https://landing.adobe.com/dam/uploads/2018/na/edu_shared_device_customer_faq_etla_vip_3dec2018.pdf
https://spark.adobe.com/page/P2Pp0UfrueMuj/

[tksja]

After creating a package (just Photoshop for now) in the Adobe Console and downloading and adding it to Jamf Admin the resulting package in Jamf Admin is of a type of "Unknown format"

I proceed to create the policy anyway and scope it to a machine. I am able to see the package in Self-Service. It proceeds to download the file, verify and execute. The result is a fail! Is there anything I am doing wrong?

The target machine is Mojave (10.14) and the version of JAMF is 10.7.1. Do I need to upgrade to a later version for this to work. We are managing the Adobe packages in our instance with a view to SSO

Any help would be appreciated

[jkaigler]

When I package CC, it comes down as a .zip file. I have then unzip it, find the .pkg in Builds and add that to JAMF Admin.

[tksja]

Thanks @jkaigler this worked fantastically well with High Sierra 10.13.6 but fails in Mojave 10.14 I am checking the logs now

[jkaigler]

If an unknown format, maybe corrupt package?

[tksja]

@jkaigler The package was corrupt but it is all good now in Jamf Admin. Still will not install on Mojave 14.2 out of Self Service. The package downloads OK, verifies, executes but results in a failure. The logs seem to indicate that it is a pathing issue. Anyone have Photoshop 2019 successfully installed on Mojave 14.2?

Many thanks

Joseph

[metalfoot77 · Accepted solution]

I was able to package up the entire 2019 suite (from Adobe console) and distribute to test machines. I also have a script to uninstall all the 2018 apps and clear the way for 2019. These run fine.

Here is my issue (as expected). When I launch a 2019 CC app, I am prompted to log in (expected). I log in and do my thing... then purposely leave it logged in. Then I try to login as a new user and guess what... all the CC apps still show my login from the first account.

This after I asked the question of Adobe in the webinar as to how to deal with this... their answer was "each user session is self contained in the user profile and there is no need to log off".

Anyone have a solution yet for this in a lab environment?

EDIT: apparently it does cache the user's info into the local profile for that user. So each user DOES have a separate session as Adobe said.

[rrouleau]

@kricotta There is an Adobe Pilot Program going on right now that looks to address this exact login issue on a multiuser/lab machine.

The way we overcame the login issue in the past, was to set up a loginhook and startup script which unlicensed and relicensed the Adobe suite.

[Dylan_YYC]

@kricotta what you said earlier has been my experience as well.

[arnokenis]

@taugust04 What OS did you use to run the user sync tool on?
I'm currently experimenting with a win10 to have the configuration of scripts set up properly. Then I will have it run as a job on a server. Doubting between linux and windows server.

[taugust04]

@arnokenis I have the user sync tool running on a Windows Server 2016 VM in our VMware 6.5 virtualized data center environment. So far so good, but other than some light testing not a lot of heavy usage so far.

[mhasman]

If behind PROXY, how do you deal with Adobe Creative Cloud client? Seems like ACC client does not go to the system network settings by authentication saved in Keychain. Is there any way to direct ACC client to use system PROXY settings?

[csanback]

@mhasman we worked with our network team and Adobe support to allow no-auth rules for Adobe's listed network addresses.

[asiddiqui]

@csanback , could you please elaborate on how you were able to get the no-auth rules set up? I spoke to Adobe support this morning, and they said that there is no way to remove the login prompt upon opening Adobe CC 2019 apps deployed through SDL...

We are a very small university, and we only buy enough seats for faculty and staff, NOT students. So for lab/classroom computers, we used our serialized license (up till CC 2018) to deploy to those computers, which removed the need for students to log in to the CC apps.

So if there is indeed a way to remove the need for our students to login on Adobe CC 2019 every time on lab computers, then I'd love to hear it.

[tsd25108]

@asiddiqui The new Adobe Shared Lab license will only utilize one license per machine, but keeps the login requirement even though it doesn't utilize the login for licensing. IE - you have to implement Enterprise/Federated Adobe ID's for users and they'll be required to login whenever they launch CC 2019 or newer, but it'll use a single "lab" license. I've already seen the option to convert my device licenses to this new type when I login to Adobe Admin Console.

[csanback]

@asiddiqui The no-auth rule was for the our proxy not the login of Adobe CC Desktop app.