Working on this as well. Instructions from CyberArk say to drop the .zip file into JAMF Admin but every time i try to add it to Admin it throws up an NilObjectException not handled error. When i try what @DirkM suggests i get errors saying invalid admin credentials even though i know the username and password are correct and my admin account has a secure token. Who's got the solution??
Been struggling with this for a bit, especially on Big Sur. This is how I got it working(mostly). Some of this also came from their support.
Things needed
- DMG created by files from Cyberark
- Script that they gave me, which I'm giving you
- Whiteboard to try and make sense of all of this
1a. Download the zip from the Cyberark server. In the zip grab your .json and the .app(also in another zip file), from there make a DMG with those two files where you want to stick them, so /tmp/ or in the case of what they told me, /Library/Application Support/JAMF/Waiting Room/. (basically what you normally do with Composer). Name it what you want, I named mine CyberArkEPMAgentSetupMacOs.dmg just to follow their instructions.
Once made, upload that DMG to your JAMF server, stick it in a policy and tell it to cache the DMG. Add a payload for the script attached. At
CYBERARKEPM_INSTALL_DMG=type in what your package is called.
From there in the script payload, set to run after and in the parameters values, stick the file name of the dmg in #4, your URL to the server (using the example they gave me) if it is
https://na115.epm.cyberark.com/then use
https://na115.epm.cyberark.com/VFAGT/vfagent.asmxfor #5.
For our location ours has the Agent Self Defense enabled so we needed to add our token in #6. You can generate that by going to the console > My Computers > Upgrade or Uninstall Agent > Action > Generate Secure Token for all Computers.
One thing that did take me a bit, was the System Extension. Their instructions only talk about adding the Team ID which was still causing prompts on install. I also had to add
com.cyberark.CyberArkEPMEndpointSecurityExtension
After that, I finally got it to install and report back to our Cyberark server. Only "hang" up now is on Big Sur after a reboot it has a pop up saying it downloaded from the internet and asking if you want to run it
The script they gave me
#!/bin/sh
####################################################################################################
#
# ABOUT THIS PROGRAM
#
# NAME
# jamfCyberArkEPMInstallFromDMG -- Install CyberArkEPM version 11.5 from DMG with configuration file
#
# SYNOPSIS
# sudo jamfCyberArkEPMInstallFromDMG <mountPoint> <computerName> <currentUsername> <dmgName> <protectionToken> -- if set is protected
#
# DESCRIPTION
# Sample script to install CyberArkEPM version 11.5 with preconfigured set
##############################
#
# 0. Download CyberArkEPMAgentSetupMacOs.zip from EPM server console.
# 1. Unzip CyberArkEPMAgentSetupMacOs.zip to the directory.
# 2. Rename the directory for something like ./CyberArkEPMAgentSetupMacOs-setX
# 3. Create DMG file by running:
#
# hdiutil create -volname CyberarkEPMAgentSetupMacOs -srcfolder ./CyberArkEPMAgentSetupMacOs-setX -ov -format UDZO ./CyberArkEPMAgentSetupMacOs-setX.dmg
#
# 4. Upload CyberArkEPMAgentSetupMacOs-setX.dmg to the Jamf server
# 5. Add CyberArkEPMAgentSetupMacOs-setX.dmg to the Policy's pkg payload
#
# Use the attached "jamfCyberArkEPMInstallFromDMG" script in the Jamf policy.
#
# You have to provide two parameters to this script
# 1. name of dmg file. As it is named on Jamf
# 2. protectionToken for the set, if the set is protected
#
####################################################################################################
#set -x
# Provide local admin user to enable macOS secure token
CYBERARKEPM_INSTALL_DMG="CHANGE THIS"
# OPTIONAL PARAMETRES STARTS FROM 4
if [ "$CYBERARKEPM_INSTALL_DMG" == "" ]; then
if [ "$4" != "" ]; then
CYBERARKEPM_INSTALL_DMG="$4"
fi
fi
PROTECTION_ARG=""
protectionToken=""
if [ "$protectionToken" == "" ]; then
if [ "$5" != "" ]; then
protectionToken="$5"
fi
fi
if [ "$protectionToken" != "" ]; then
PROTECTION_ARG=" -token $protectionToken"
fi
JAMF_CACHE_LOCATION="/Library/Application Support/JAMF/Waiting Room"
echo "Check if dmg file exists."
if [[ ! -f "$JAMF_CACHE_LOCATION/$CYBERARKEPM_INSTALL_DMG" ]]; then
echo "File $JAMF_CACHE_LOCATION/$CYBERARKEPM_INSTALL_DMG not found"
exit 2
fi
CYBERARKEPM_INSTALL_TMP=$(mktemp -d -t ci-XXXXXXXXXX)
rm -fr $CYBERARKEPM_INSTALL_TMP
mkdir -p $CYBERARKEPM_INSTALL_TMP
sudo /usr/bin/hdiutil attach -nobrowse -mountpoint $CYBERARKEPM_INSTALL_TMP/dmg "$JAMF_CACHE_LOCATION/$CYBERARKEPM_INSTALL_DMG"
ditto -xk $CYBERARKEPM_INSTALL_TMP/dmg/Install CyberArk EPM.app.zip $CYBERARKEPM_INSTALL_TMP
cp -a $CYBERARKEPM_INSTALL_TMP/dmg/CyberArkEPMConfiguration.json $CYBERARKEPM_INSTALL_TMP/CyberArkEPMConfiguration.json
xattr -d $CYBERARKEPM_INSTALL_TMP/Install CyberArk EPM.app
sudo /usr/bin/hdiutil detach $CYBERARKEPM_INSTALL_TMP/dmg
#Cleans Up the dmg so it doesnt take up space on machine
rm -f "$JAMF_CACHE_LOCATION/$CYBERARKEPM_INSTALL_DMG"
rm -f "$JAMF_CACHE_LOCATION/$CYBERARKEPM_INSTALL_DMG.cache.xml"
cat "$CYBERARKEPM_INSTALL_TMP/CyberArkEPMConfiguration.json"
echo "Installing..."
$CYBERARKEPM_INSTALL_TMP/Install CyberArk EPM.app/Contents/MacOS/CyberArkEPMInstaller -withoutPwdRotation -configuration "$CYBERARKEPM_INSTALL_TMP/CyberArkEPMConfiguration.json" $PROTECTION_ARG
epmVersionFull=$(/usr/local/bin/CyberArkEPM --version)
echo "Cleaning up"
rm -fr $CYBERARKEPM_INSTALL_TMP
if [[ ! $epmVersionFull ]]; then
echo "CyberArk EPM installation failed"
exit 2
fi
echo "$epmVersionFull was successfully installed"
exit 0@KCouture - this is essentially how I was able to get this to function in our environment as well, with one exception, we also added the PPPC settings that @spraguga provided above, I believe this will solve your app downloaded from the internet prompt(though don't quote me on that as I've only tested on 10.14 and 10.15 machines.
Interestingly enough, on a handful of 10.15 machines the install is failing with the below:
Executing Policy CyberArk EPM Agent v.11.8.0.722 Caching package CyberArkEPMAgentSetupMacOs-setX.dmg... Downloading https://use1-jcds.services.jamfcloud.com//download/25bf2928931e4f1fa129b89da4dfb751/CyberArkEPMAgentSetupMacOs-setX.dmg?token=d076ef6da9174490a4ed1add33e0fc887vytaz1rkvnube7vd831z5l5yyyurh82... Verifying DMG... Running script CyberArk_Install_From_DMG... Script exit code: 2 Script result: Check if dmg file exists. expected CRC32 $08F7B48B /dev/disk2 GUID_partition_scheme /dev/disk2s1 Apple_APFS /dev/disk3 EF57347C-0000-11AA-AA11-0030654 /dev/disk3s1 41504653-0000-11AA-AA11-0030654 /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/ci-XXXXXXXXXX.8AhCZhik/dmg "disk2" ejected. {"url":"https://login.epm.cyberark.com/VFAGT/VfAgent.asmx","setID":"ce250d0a-e3f1-4b1e-89ea-06b9738c345d","certificateCommonName":null,"registerToken":"dioP2qnSmvxvIntbJdZWSDPpjkqjOY20EvWvPVbqnyQ+TDdD83lFogSv4w79scPeHfg8fDcZEZIdpS1JcKPmkwvvechpJxtnHgRTz0gG9ptrA5BF0FATsaMG0yz7iWuTWfE6OJghmjPeAl+DWgSEyzWV24Lc6v3CrbNRu9XnBJwZxP0uITVUmhudDmAj5kk4yXVlLpIEVgEikEjBBo6UfBo+PdsiYVL8AbSPf5bXZrdtrSOMFKdghjpFD1wqrJRkJdZlEOA7w9dEXLxgwkE0+BWM712Bfcu5ZT5HCU0V8t/IZ1Kxtq3voYiyk1pT4QCEtDLwjZpsfSsf/iOmsbS5Mcz5D+jpi/dV/Aw4UcnZPYM/nzkHaGCtIkwOCwSMbygH+NGVzXzC+d9BPmBK4pRaTSeMZzffUNAu26Jr6z43SUJu4VwHRBfdh94q9g2KQYUTWq1tO7d+mjSTXyP6rIcvycpnuTT8Mi9OrKcZN1NTPhGxjITyIwhqXAthor5x2qh7fANB2qLKCVaEIU2Bc4aN2Yz55MK0gDYbzEYhrGwi3vVCjuhccCqWuQPqOKCct1IeW2tUYnOfkW0KIb/GuNpGT9rxMCcmXD9oNwpxnGKNGCDuuTYn6Sa//Q8elbShqEUB9poO9q144cmw04PpoFpByvYnu8TTI69SdM6zeXa0nxMxP7I7JBAAx1whVMAYhpmqj8m4CPLOU53EglgtRVIhZ4cWRtB/ttAbcCDoA+Pw2XboD9RmC5DNGuWhaWzP0L7lDKYsU0ozsjVqVM0sUvfXnSIRuyg3MiLHQUUtF6d8MZPhBFo+we2azEPez09d5+9Bc2a47YEBzhdCvxFOPuaWY0B6ele7xv/osQojbUWP2wNq5Zd7LW+mLT4ayzSLdriUZGoFbt8MttidmQK636c16jgL/Xy/A3a46rmxD16aE8XSiwfX4yk7dw8MriZvvNiY5vMOsJqRCc8L5+cCdBX1pg==","registerTokenExp":"2004457654"}Installing... Failed to check self-defense status: Error Domain=NSCocoaErrorDomain Code=4 "The file “CyberArkEPM” doesn’t exist." UserInfo={NSFilePath=/usr/local/bin/CyberArkEPM} /Library/Application Support/JAMF/tmp/CyberArk_Install_From_DMG: line 98: /usr/local/bin/CyberArkEPM: No such file or directory Cleaning up CyberArk EPM installation failed Error running script: return code was 2.
Curious if anyone else has seen this and knows what may be happening? It appears that perhaps the cached DMG is not being mounted/extracted properly? I'm not a scripting guru so am not sure.
I do have a PPPC made up for it, but mine looks different than yours. I did make mine with the old version of Cyberark installed so I'll give that a go
@tvargas - yes - apologies i meant to update this thread and forgot....there was actually a formatting issue in the PDF published by cyberark, it took a support call and digging into it to find out...an extra whitespace if i remember correctly. I was copying/pasting the PPPC code. i would have expected them to update their PDF by now, but if not here is the PPPC section of the config profile we are using:
The code requirement for this identifier 'com.cyberark.CyberArkEPMEndpointSecurityExtension' is:
anchor apple generic and identifier "com.cyberark.CyberArkEPMEndpointSecurityExtension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate leaf[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = DF8U2CCCD8)
The code requirement for this identifier 'com.cyberark.CyberArkEPM' is:
anchor apple generic and identifier "com.cyberark.CyberArkEPM" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = DF8U2CCCD8)EDIT: The screenshots are reversed from the order i uploaded them, sorry about that, but you should get the gist.
