Skip to main content
Question

LDAP connection- MFA Authentification not working

  • September 10, 2019
  • 5 replies
  • 0 views
P
Forum|alt.badge.img+4

Hi Jamf,
we have setup a LDAPS connection from our OKTA instance to Jamf. The reason for this is to have users to authenticate during first iOS enrollement.
This works fine so far, with one minor blocker. Our Okta SSO uses MFA authentication. When the user has setup okta verify push, he will receive a push notification on his other device and the login will complete successfully.
Unfortunately there is no indication on the iphone that a push notifcation is beeing sent, and also there is no way to enter any one time password.
this means if the user doesn't use Okta verify push, but Google Authenticator (our second MFA option), he won't be able to enter the code and therefore sign in and setup will fail.

Bottom line:
Without using okta verify push, the iphone setup is not possible.
Hope this makes sense to you. do you have any idea on what we can do in this situation? Should this be a feature request?

Best, Patrick

5 replies

Z
Forum|alt.badge.img+9

If you are using jamfcloud you need to add those IPs as a network zone in okta and exempt that range from MFA. If you are on Prem, you need to use the IP Range of your jamf instance as a network range instead. We do this for our enrollment and works like a charm! Happy to chat more. Feel free to let me know if you need more specific instructions.

adam_macy1
P
2 people like this
  • adam_macy1
    adam_macy1
  • P
    patrick030
P
Forum|alt.badge.img+4
  • patrick030
  • Author
  • Contributor
  • 10 replies
  • September 10, 2019

Hey Zachary,

thx for your quick response.
I will try this and come back to you if we have any problems ;).

Thank you

O
Forum|alt.badge.img+1
  • OJtheD
  • New Contributor
  • 7 replies
  • December 18, 2020

"If you are using jamfcloud you need to add those IPs" - which IPs? Where can we find them?

Z
Forum|alt.badge.img+9

Here you go!

https://www.jamf.com/jamf-nation/articles/409/permitting-inbound-outbound-traffic-with-jamf-cloud

O
1 person likes this
  • O
    OJtheD
G
Forum|alt.badge.img+3
  • gregreznik
  • New Contributor
  • 16 replies
  • January 11, 2021

Yes you will need to whitelist the jamfcloud IPs, or if you don't want to do this I believe you can instruct your users to use the MFA code in their Okta Verify app (or whatever MFA verify app they use) to type in the <password,MFAtoken> to login. Okta supports that kind of MFA authentication for LDAP.

Source: https://help.okta.com/en/prod/Content/Topics/Directory/LDAP-interface-MFA.htm

O
1 person likes this
  • O
    OJtheD

Reply


Most helpful members this week

Terms & ConditionsCookie settingsAccessibility statement

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings