Auto login to self service

[Marty]

I am trying to figure out if we can have users auto logged in to Self service when they open it/log in to the machine.

[damienbarrett]

Are your users logging into their Macs with local accounts? Are the computers bound to AD or OD?

[NoahRJ]

Yep, you can toggle that as a setting in your JSS. Navigate to https://your.JSS.url:8443/selfService.html (also accessible by going to Settings > Computer Management > Self Service), and under the login tab, you can change the User Login to "No login" to have Self Service launch without requiring credentials.

[alexjdale]

There is no SSO option though, correct?

[mm2270]

There is no SSO option i'm aware of. SS now shows you your username in the upper right side, but it would show a local username just the same as an AD account. We just don't have users log in at the Self Service screen, so it just auto logs in.
The only downside is that I believe you can't really use policies scoped only to LDAP accounts or groups when its set up that way.

[bentoms]

@damienbarrett, actually acoping works. IF combined with grabbing the user information @ login.

As per: https://macmule.com/2014/05/04/submit-user-information-from-ad-into-the-jss-at-login-v2/

Caveat is, if you open self service right after login & the last logged in user had differing items you may seek them until a launch of self service post recon submition.

[Marty]

Using an AD account. If i set it to no login would it still push the policies for applications I have set to user groups?

[bentoms]

It will as long as you're grabbing the user information as per what I posted above.

[bradtchapman]

@bentoms So if I'm understanding this correctly, the LDAP scoping technique is actually basing its decisions on whatever username is configured under "User and Location" in the JSS computer record. Is that right?

Because right now we have Self Service set to "No Login" and yet a username appears in the top right corner when the application is open. When I scope a policy to an LDAP user or group, that policy appears in SS if that username falls under the scope.

[bentoms]

@bradtchapman Pretty much.

If you're pulling in other LDAP attributes you can also scope via that too.

[bradtchapman]

@bentoms , Self Service is set to "No Login" and we are collecting information from LDAP during recon, like your article suggests. LDAP configuration is good, and Self Service policies appear for that user when scoped to an LDAP group they belong to.

When I run the policies, I see "Gathering Information..." for a few seconds, the progress bar fill up and then it disappears. Self Service thinks it ran, but there is absolutely no record in var/log/jamf.log and the JSS shows no activity either.