Hi Folks,
It’s been a while since the last time I posted, and I have been tinkering with a few side projects. Hopefully I can bring more cool stuff to the community once these projects come to fruition. Today, I’m excited to introduce the first one:
What if you’re using Okta as your primary IdP but are also yearning for JumpCloud’s UEM features?
Imagine using Okta SCIM to provision users (and their passwords) to JumpCloud, then letting JumpCloud sync the same identity to the device while managing it simultaneously. Sounds intriguing, right?
Let’s dive in!
Considerations & Prerequisites
- Most of your user management tasks, such as updating user attributes, creating new users, suspending users, and changing passwords, will still be handled in Okta.
- Ensure the JumpCloud agent is installed on all devices. (Apple MDM is optional at this stage for macOS).
- Set the default user state like this:
- Configure Okta SCIM provisioning to JumpCloud.
- Establish an Okta identity federation with JumpCloud.
- (Optional) Create a user group to host the Okta federation users. You can automate the group memberships via JumpCloud’s Dynamic Groups feature like this:
- Last but not least, create a routing policy to direct the in-scope users.
Now it’s all set, let’s dive into a few scenarios to see how it looks from a user perspective.
Scenario 1 - Onboarding a new user
First, create a new user in Okta.
- Make sure to activate the user now.
- you can set the password on-behalf.
- (Optional) Set a value here in order to be added to the routing group automatically in JumpCloud.
Next, the user will get provisioned (self-serve) on the device.
MacOS
Windows
Scenario 2 - Taking over the existing user on the device.
- Full steps and details you may find here. In our case, just edit the provisioned user like this:
- Then, binding the user to device, Okta password will be channeled to the device via JumpCloud Password Sync:
Scenario 3 - When user change their password on Okta.
In this particular setup, as mentioned above, user will manage their passwords in Okta only. You probably will consider hide the JumpCloud tray app (which empowers the user changing their JumpCloud passwords on-device) to avoid confusion.
Create and bind the policies below to device groups respectively.
Hide Windows App Using a Policy - JumpCloud.
Create a Mac JumpCloud App Controls Policy
On Windows, after the password change, user will need to login with the new password to re-engage Windows Hello (PIN or biometric):
On MacOS, user will need to input the previous password in order to regain access to keychain:
Scenario 4 - Suspending the user.
When you deactivate or delete a user in Okta, the user is placed in a suspended state in JumpCloud.
- The user session will be ended from the device instantly, the account will be disabled (not deleted).
- On Windows, you won’t be able to see the user at the login screen
- On MacOS, it looks like this.
That’s it (for now)! Thanks for reading this far, hope these use cases are helpful, and feel free to comment below if you have any questions/feedback.
Catch you up on the next one!
