Any using or tried JumpCloud for LDAP?

Hey Tony,

We are actually working to implement it now. We are in a test phase before we roll out. Same situation. No directory server, in need of one ASAP, however trying to stay cloud first and focused. Still no servers on prem so far ;-)

Let me know if you have any questions or have had a chance to try it out. I can't find too many others who have experience with it so far. We did have lunch with the CEO and it is a very fascinating product. There may be some immaturities within the current build, but only expect the product to grow. We do know, it does not integrate with Okta well, but does integrate with Bitium very well.

Regards,

Anthony

Thanks for the response. Our need for LDAP is only really to make Casper work better for enrolling and assigning/managing computers. I am torn whether to investigate this further or just set up a simple open directory on CentOS, or even use our Mac mini Casper server to run Open Directory. Rather have a cloud solution if possible (and worth the money). Or I could also forget it and enter user info manually.
Hmmm...

@tony.schaps could you use a limited enrollment-only account to enroll the devices and fill in any other information important to you manually? Do you have a lot of users that would make using LDAP worthwhile?

@tony.schaps I've been looking for a cloud directory service for a while now, and haven't found one I liked. This was the first I heard of JumpCloud, but after about 10 minutes I've got it talking to my JSS and user and group lookups are working as expected. I plan to hammer on it more, but so far it seems like a totally viable option for assigning computers to users in the JSS.

@mpermann I do have a limited enrollment-only account, but we're at about 130 staff adding 15-20 per month. I'd much rather edit a directory record linked with an asset than to do it all manually, although I certainly could do it manually. There are other services we have which might also be able to be simplified as we grow by linking to an LDAP. It could make on- and off-boarding a lot easier. Kinda wish we could just do it with Google Apps, which we have anyway, but as I understand it, will not work with Casper Suite. Thanks!

@kitzy Cool, thanks for the info. I may have enough reason to demo JumpCloud now. Don't have the skillz with Casper yet, though. Thanks!

@tony.schaps no worries, happy to help! I'll probably end up blogging my findings after some more testing. I'll post back here with the link if/when I do.

Hi, guys, I'm James Brown, JumpCloud's Chief Architect.

Just saw this thread and wanted to point out a couple of things:

1. We actually work very well with Okta. You can find an integration video (https://jumpcloud.com/engineering-blog/integrating-okta-and-jumpcloud-with-ldap/) and step-by-step instructions (https://jumpcloud.com/engineering-blog/integrating-okta-jumpclouds-ldap-service/) on our engineering blog, at: https://jumpcloud.com/engineering-blog .

2. We can also help you to integrate your Google Apps users with JAMF software. We can import your users, and then expose them to the rest of your infrastructure via LDAP, RADIUS, through our local agent. That means you can expose your Google Apps users to JAMF Casper, as well!

Many of our customers use both JAMF Casper and JumpCloud together, so we'd love to help you add JumpCloud's directory services to JAMF Casper's already-considerable capabilities.

If you've got any questions, feel free to email me directly at james@jumpcloud.com.

Thanks!
James

We can also help you to integrate your Google Apps users with JAMF software. We can import your users, and then expose them to the rest of your infrastructure via LDAP, RADIUS, through our local agent. That means you can expose your Google Apps users to JAMF Casper, as well!

This is gold. Is there documentation on this configuration anywhere?

Here's how that configuration looks:

1. Connect JumpCloud to Google Apps (http://support.jumpcloud.com/knowledgebase/articles/613809-getting-started-with-google-apps-user-import-prov)
2. Set up JAMF Casper to connect to JumpCloud's LDAP service (https://jumpcloud.com/engineering-blog/integrating-jamf-softwares-lamf-cloud-with-ldap/)

Once done, your Google Apps users will be imported into JumpCloud, and then they'll be exposed through LDAP to JAMF Casper!

If you run into any trouble, please email support@jumpcloud.com.

James

We are in the middle of implementing Jump Cloud and we found an issue with keychain. Changing the password on the Jump Cloud portal will not change the password for keychain, therefore not syncing with FileVault. Changing the password locally (Users & Groups) will not change the directory account password and will cause keychain problems. The have said they are 50% of the way with integrating this piece and when I was initially testing the jump cloud agent and it was unsigned but the new agent 0.9.561 is signed.

Seems they have a few issues to overcome. But this could be a great cloud directory service. Just a heads up!

Rick

We are also taking a look into jump cloud. Is there away to just bind the computers and then have the users input their username and password in a lab setting? I have been trying, but it seems I have to push individual suer accounts via jumpcloud. Thanks for any help.

@jared_f there used to be a knowledgebase article on JumpCloud's website explaining how to bind Mac OS X to JumpCloud. I printed it out last November when I was testing with JumpCloud. I searched their website and was unable to find it. The article number was 2439994. I emailed their support asking why the document was removed. I scanned my printed copy and you can access it here. If I hear back from their support people I will update the thread with hopefully a valid link from JumpCloud's website for the article. After binding a computer to JumpCloud using the method in that article I was able to login using a set of JumpCloud credentials to log into the computer. I didn't assign the user I logged in with to the computer in JumpCloud and I don't have the JumpCloud agent installed on the computer I used. If you need further help let me know.

@mpermann Thank you! This worked perfectly.

Hey Guys,

Just an update, I am testing this here I will let you guys know my findings.

Rick

I am going to see if I can find or write a script that will complete this binding process for us. It is a few more steps than normal bindings.

@jared_f give the instructions that @rlincoln posted above your post. I gave those a try and those seemed to work as well. You may no longer need to do step #18 in the instructions I posted above. The newer instructions might be more standard and you might be able to do it with Casper or use some existing binding scripts.

@mpermann I am going to take a look into a binding script later today. I will get back to you.

@jared_f I did receive a response from JumpCloud on why the original article that I provided you had been pulled. Below is there response:

...the reason the knowledge base article you are referring to has been pulled is because we no longer support LDAP binding on systems, and rather require the JumpCloud agent.

If anyone has any ideas on how to get access to groups on a Mac OS X Server that is bound to a JumpCloud directory I'd love to know how you did it. That's the last hurdle I'm trying to clear with the POC I'm doing with their product. If I can get a Mac OS X Server properly connected to a JumpCloud system and be able to assign folders on the share to groups pulled from the JumpCloud directory I would be thrilled.

@mpermann The issue with the JumpCloud agent for me was that it doesn't allow users to log in and build a home folder. I literally have to push it from JumpCloud admin dashboard. That document you scanned allowed me to bind the computer to JumpCloud and now allows me to log in using credentials. Have you had any different result with the JumpCloud agent? This would be an issue with a lab environment. I really like the idea of cloud hosted directories because then they are always online.

@jared_f when I installed the agent on a test computer, as long as I assigned users to the computer in the admin console I could login with their credentials. I don't imagine that would be very convenient for a lab situation though. I don't know what their workflow looks like for that situation. They need to do some more engineering on their agent. They don't have local keychain password and FileVault password sync working. The Nomad folks have that sorted. They also make the /opt directory visible which isn't a good idea in my opinion.

@mpermann I have been testing it on a test MacBook and it seems to be working ok. I am binding the computer via the steps in the document you provided and also installing the agent. I am creating fresh users and not pushing them to the computers via the admin console. I enter the credentials, it accepts, and builds the home folder. The only issue I have seen is that logins take an average of about 20-25 seconds. I am going to keep investigating.

@jared_f is it just on initial login that you are seeing the delay? Is the system FileVault encrypted? If it is just on initial account creation I would consider that normal behavior as it is pulling down the account info creating the home directory etc

@rlincoln I agree, it is most likely normal behavior because (as you said) it is creating a home directory. I personally think it is slower than an on-premise directory server. Obviously, it has many, many upsides for reliability, etc. I am looking into giving new laptops out next year and will probably user JumpCloud for our directory. I am looking into finding a script for binding (so I do not have to push users directly down to the machines).

I just got off the phone with Jump Cloud and they said the no longer support that method as using the JC agent it will always be available instead of having to the on your network or VPN to auth against. We are going to test managing Jump Cloud through Casper. I will know more next week.

Rick