Login to MacOS using Classlink SSO?

[johntgeck]

Hi there,

I'm not sure if this functionality exists for MacOS, but it does for Chromebooks, and it's pretty amazing, so we'd like to leverage it for our iMac labs at the very least, and if it works there maybe go org-wide with it. The problem is I'm not sure what method to attack this problem with.

Currently our iMacs (like the rest of our Apple computers) are AD bound. Users log in with a mobile account, and use Enterprise Connect for password management.

I know that Macs support Kerb/SSO authentication, and also that Google's SecureLDAP can work for macOS as well, but what I really want is for the login screen to show me a Classlink login page so users can sign in with a QR code badge.

Since our Google accounts use Classlink as their IDP and show the splash page when you try to log into them via web browser, I started going down the rabbit hole of getting a test machine bound to Google Secure LDAP, thinking it might spawn a splash page for Classlink login. But now I'm realizing that mechanism probably won't happen.

I realize I'm sort of rambling here, but I'd be interested in anyone else's experience getting to an IDP login screen on MacOS where you can scan in using a badge, regardless of platform or mechanism.

[nick_mangogna]

Stumbled across this feed. With the CVE-2021-42287 issue with AD Bindings this may become more prevalent I would definitely be interested in this as well. 

[johntgeck]

We can dream, friendo. We can dream. 😅

[whiteb]

This might be possible with XCreds. Kind of like a more modern version of NoMAD. Link: https://twocanoes.com/products/mac/xcreds/

I've seen two people on the #MacAdmins slack get it halfway working, but couldn't quite get it fully working.

Tidbits from them trying to get XCreds working with ClassLink at macOS sign-in window (XCreds does support 'JIT' aka 'Just In Time' local account creation, like NoMAD does).

"We had the same problem, and we use Classlink as an IDP for Google. I could only get an account created with a manually defined username in the config profile. Since Google takes us to the separate classlink page, I think thats why the username isn't getting pulled. It would be nice if we could do the same thing as passwords, defining the elementID field, since there is no @email.com part in our login, though I'm not 100% thats the best solution."

"I am testing xCreds with Google. We are using Google as a Single sign-on (SSO) with a third-party identity provider --> Classlink.com. XCreds will go to Google then to Classlink back to Google without passing the authenication back to xCreds. How can I get xCreds to see the authenication?"

Both those posts were 2 - 3 months ago. I asked them if they ever made any more progress but haven't heard back.

We're personally looking to get rid of NoMAD this year so this is something I will test myself in the next few months. NoMAD is still working great for us in a K-12 shared lab setting, even on the latest Ventura.. I just don't like how it's kind of a ghost project at this point. It would also be nice to use our ClassLink IdP. XCreds is all written in Swift and a modern solution (if not cutting-edge).

[johntgeck]

Just coming back to this thread due to notifications. Honestly thank you for the detailed reply! Would love to hear more about how it's going for you. We're still binding macs to AD and using mobile accounts + Enterprise Connect (since Apple KSSO can't sync passwords in this circumstance), but I'm looking to test out local accounts + JamfConnect sometime when I get enough time to do some research (probably the 12th of Never, but hoping maybe after the fall ticket rush).

[whiteb]

Hi there. I looked into integrating XCreds with ClassLink heavily. I ultimately found that I need TwoCanoes to work with ClassLink to build an integration, there's no way to get a client secret, etc.. without being a ClassLink Developer. Tim @ TwoCanoes said he would be open to building this. ClassLink doesn't charge software vendors for integrations. I'm not quite sure where he's at with that, I haven't heard from him lately.

I'd really like to get it to work because XCreds is a small fraction of the cost of Connect, even with Education pricing. XCreds is $1 per device, per year (Education) which is unbelievably cheap. And that would come with support. Jamf support has really gone downhill in my experience.

I can keep you posted there, I know there are other ClassLink customers interested in XCreds.

Apple is also teasing Platform SSO with Sonoma. I'm not quite sure what that looks like yet. Not holding my breath on it personally, I'd totally pay for XCreds @ $500 per device / year, with support. We have some devices that won't support Sonoma that we still need the ability to let any user login.

[Green_Giant]

I’m looking at all avenues at the moment. Gonna be able to check out Jamf connect a bit more after I roll Classlink out to staff and students in August. It looks like the Xcred team is doing some cool stuff and lots of support from Twocanoes and the community, biggest hurdle with Twocanoes is they don’t do purchase orders which creates a bunch of red tape for my company but if they 100% support id go through the headache of getting it purchased. 

[whiteb]

For sure. ClassLink has been awesome for us btw. Wasn't aware of the no P.O. thing, hadn't even gotten that far with them. Good to know, as that could be an issue for us as well (we're K-12). Connect will be a little more turn-key and easier to implement. We piloted it in its early stages, but switched to NoMAD because Connect's main advantage is giving a remote user a fresh device, and they can sign in and create an account off-network, and we're just never really doing that, so didn't want to pay for something we weren't going to take advantage of.

[Green_Giant]

new to Classlink but am interested in using Xcreds or Jamf Connect with Classlink for Lab accounts.

[johntgeck]

Yeah we're still on AD mobile accts and Enterprise Connect, I'm looking to go JamfConnect when I have time to test.

[Green_Giant]

All good, Im planning on getting Jamf Connect for the fall ill update the thread to share what can be done.

[whiteb]

@johntgeck @Green_Giant

With the school year winding down I found some time to try and get this to work. Essentially we're trying to get away from using NoMAD now that it's end-of-life. Our Jamf rep got us some kind of bundle deal with a bunch of Jamf Connect licenses. We're currently still using NoMAD in shared labs and some shared laptops.

I have both ClassLink and Google working at the login window, each with a caveat.

ClassLink:

Loads a generic ClassLink page unfortunately, even with everything set up correctly. I can find our domain by typing one word, select it, and then get brought to our personal ClassLink login page. From there I can successfully login.

ClassLink has stated "The redirect to the generic ClassLink page is intended with the OIDC/OAuth2 workflow. The reason being is this will allow for universal functionality. Unfortunately we cannot manipulate the issuer url to redirect your login page."

Google:

Shows a Google login page. User has to enter a valid email, and it will then direct them to a ClassLink login page. This is the behavior I was expecting unfortunately. Our Google Workspace is setup so that ClassLink is our primary IdP for SSO. So Google essentially just points to ClassLink. Our Chromebooks show a ClassLink login screen, although that's SAML which Jamf Connect doesn't support. It would just be a quality-of-life improvement to not require Students and Staff to have to enter their full email, and then username and password.

Both options are working in the sense that cloud identities can successfully sign in and have a local account created. But I'm just not quite happy with either for the reasons stated. I think we're still going to proceed with Google for now. I have the Jamf Connect menu bar app set to sync passwords with Google LDAP and that seems to be working fine. That should play nicely with either Login Window IdP.

I did have a call today with ClassLink and they said they will reach out to Jamf to try and build a proper integration. If this is something you're interested in, I suggest you let your ClassLink and Jamf rep(s) know.

The below is the desired login window. And I can get to this screen from either of the above, it just takes a little bit of interaction.

I tried literally everything to accomplish the above for either ClassLink or Google, and hit a wall. I did a bunch of digging through OIDC documentation and found that there is a parameter which Google's implementation could accept called 'hd' - "Streamline the login process for accounts owned by a Google Cloud organization. By including the Google Cloud organization domain (for example, mycollege.edu), you can indicate that the account selection UI should be optimized for accounts at that domain." - https://developers.google.com/identity/openid-connect/openid-connect#hd-param.

"You can optimize the Google Workspace login screen to a specific hosted domain by using the hd parameter." - https://docs.openshift.com/acs/3.66/operating/manage-user-access/configure-google-workspace-identity...

Unfortunately I don't have any way to pass that variable in the request in Jamf Connect.

So the current plan is to still go the Google + Jamf Connect route to get off of NoMAD, and hopefully in the future ClassLink and Jamf have officially partnered and we can switch to using ClassLink for the Login Window.

Edit: Jamf Support told me to create a feature request, which I have done: https://ideas.jamf.com/ideas/ID-I-391

Feel free to upvote.

[johntgeck]

Thanks for the awesome, detailed response. I'm going to edit my post as well -- we also ended up going Jamf Connect + Microsoft Entra (federated domain with IdP set to our Classlink portal). It's not ideal because it's a multi-stage login window, but it does work.

[johntgeck · Accepted solution]

We ended up implementing Microsoft Entra/Azure and JamfConnect to get away from AD-binding, and since we needed password syncing to work with our backend on-prem AD. Currently it's a multi-stage login, which is not ideal, and does not support Classlink QuickCards since you need to type in your 365 login to be prompted with the Classlink portal. We'll keep our fingers crossed for a Classlink implementation.