Enforce Okta Device Trust for Jamf Pro-managed macOS devices

Okta Device Trust for Jamf Pro-managed macOS allows you to prevent unmanaged macOS computers from accessing corporate SAMLAn acronym for Security Assertion Markup Language, SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). The SAML standard addresses issues unique to the single sign-on (SSO) solution, and defines three roles: the end user, the IdP, and the SP. Here's how SAML works through Okta: SP-initiated flow: the end user requests (principally through a browser) a service from the SP. The SP requests and obtains an identity assertion from the IdP (in this case, Okta). On the basis of this assertion, the SP can decide whether or not to authorize or authenticate the service for the end user. IdP-initiated flow: with Okta as the IdP, an end user goes to the Okta browser and clicks on an app, sending a SAMLResponse to the configured SP. A session is established with the SP, and the end user is authenticated. and WS-Fed cloud apps. Device Trust ensures that only known and secured devices can access your Okta-managed applications.


ClosedDiagram — device authentication and certificate flow


ClosedPrerequisites
  • This solution works with:
    • Apple computers running Okta-supported versions of macOS.
    • Jamf Pro MDM solution
    • The following browsers and native apps capable of accessing the Okta Keychain on the managed computer when performing the federated authentication flow to Okta:
      • Browsers: Chrome and Safari browsers
      • Modern Auth-enabled native apps:
        • Box
        • Google Drive
        • Microsoft Office
        • Skype for Business
        • Slack
  • The Mutual TLS certificate exchange (handshake) in this Device Trust flow occurs on Okta URLs that are separate from your Okta orgThe Okta container that represents a real-world organization. URL (indicated by the wildcard character (*) in the example below). If you implement endpoint protection software, make sure to configure it in a way that does not block your clients from completing the certificate exchange with Okta. For example, if your organization uses a whitelist to limit outbound traffic, add these exact URLs to the whitelist, including the wildcard character (*), as shown here:

    *.okta.com

    *.okta-emea.com


ClosedProcedures

ClosedPart Ⓐ — In Okta: Enable the global Device Trust setting for your org
  1. From the Okta AdminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page. Dashboard, go to Security > Device Trust.
  2. In the macOS Device Trust section, click Edit.
  3. In the wizard that launches, select Enable macOS Device Trust.
  4. (Optional) In the Learn more field, you can enter an externally-accessible redirect URL where end usersEnd users are people in your org without administrative control. They can authenticate into apps from the icons on their My Applications home page, but they are provisioned, deprovisioned, assigned, and managed by admins. with untrusted devices can find more information. The security message shown to these end users will include a Learn more link that redirects to your specified URL. ClosedScreenshot

    If you choose not to specify a URL in this optional field, these end users will be shown the same message but without the Learn more link. ClosedScreenshot

  5. In Trust is established by, select Jamf Pro.
  6. Enter information about the Jamf Pro API, such as the Jamf Pro tenant URL (for example, https://example.jamfcloud.com, not the API URL), credentials, and key.

    This information allows Okta to verify that end user devices are managed by Jamf Pro at the time of certificate enrollment. For Jamf Pro, you need at least these READ privileges to access Jamf APIs in order for Okta to verify that the device is managed:

    7. Important: Okta strongly recommends that you create a separate user for API access that is separate from the user your organization uses to access the Jamf Pro admin interface.

  7. Click Test API credentials. A success message appears if a connection is established with your MDM provider's API.
  8. Click Next.
  9. On the Configure MDM Provider screen, click Download to obtain a python script. You'll modify the script in Part B below.
  10. To copy the provided Secret KeyAn Okta-generated string of characters that allows end users to set up (enroll) their mobile device in to Okta Verify. End users enter the Secret Key in the Okta Verify app during the set up process as an alternative to scanning a QR code. Value and Org URL to your clipboard, click the copy icon adjacent to the fields.

    11. Important: Make a note of the provided Secret Key Value and Org URL, as this is the only time these will appear in Okta. Also, if you later want to edit your configuration and generate a new secret Key through the Reset macOS secret Key button, you must perform this procedure again.

  11. Click Done.
  12. Modify the downloaded Okta Device Registration Task as described in Part B.

    The latest version of the Okta Device Registration Task is also available from the Settings > Downloads page of the Okta Admin Console.


ClosedPart Ⓑ — On Admin's computer: Modify the Okta Device Registration Task

ClosedUsing endpoint protection software?


The Mutual TLS certificate exchange (handshake) in this Device Trust flow occurs on Okta URLs that are separate from your Okta org URL (indicated by the wildcard character (*) in the example below). If you implement endpoint protection software, make sure to configure it in a way that does not block your clients from completing the certificate exchange with Okta. For example, if your organization uses a whitelist to limit outbound traffic, add these exact URLs to the whitelist, including the wildcard character (*), as shown here:

*.okta.com

*.okta-emea.com


  1. Go to your Downloads folder and open the script you downloaded from Okta.
  2. Modify the script by pasting in the Secret Key Value and Org URL you generated in Part A.

    3. When entering the key and the URL, retain the single quotation marks ( ' ) but replace the parentheses and the placeholder text with the actual Secret Key Value and Org URL, as shown in the following example:


    Example: Script before modification


    Example: Modified script. Note that you must retain the single quotation marks but not the parentheses.

  3. (Optional) Modify the default appAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. whitelist.

    4. By default, the Okta Device Registration Task whitelists some popular appsMicrosoft Office 365, Box, Google Drive, Skype for Business, Slack so that end users aren't prompted for the keychain password when accessing them. You can modify the default whitelist as described in Part G.

  4. Save the script.
  5. Proceed to Part Ⓒ.

ClosedPart Ⓒ — In Jamf Pro: Add the modified Okta Device Registration Task to Jamf Pro and distribute it to macOS devices

ClosedClick: About the Okta Device Registration Task

The Okta Device Registration Task is a script that is distributed by Jamf Pro to the macOS devices you have targeted for this Device Trust solution. When deployed on the device, the Okta Device Registration Task does the following:

  • Registers with Okta to obtain a Device Trust certificate. Okta checks with Jamf Pro to make sure the device is managed.

  • Configures Chrome and Safari browsers and tested native appsThese Modern Auth-enabled native apps: Microsoft Office 365, Box, Google Drive, Skype for Business, Slack on the device to present the certificate automatically during secure app access.

  • Schedules a lightweight task that runs once a day and whenever users log in to their computer. The task checks whether the Device Trust certificate is expired and tries to renew the certificate 30 days before expiry. Certificates are valid for 1 year.

  • During renewal, Okta performs checks similar to those that occur during registration, such as checking whether the device is managed before issuing a new certificate.
  • After the script runs on the device once, Jamf Pro removes it from the device automatically.
  • You can use the following query to determine which version of the Registration Task is installed on the device:
    python ~/Library/Okta/okta_device_trust.py version

Create the workflows that make sense for your organization, making sure that the script runs at least once successfully to enroll the Okta certificate.

  1. In Jamf Pro click the gear icon to go to All Settings.
  2. Go to Computer Management > Scripts.
  3. Create a new script and paste into it the Okta Device Registration Task you downloaded from Okta in Part A and modified in Part B.
  4. Save the script.
  5. Create a policy to deploy the script to one or more Target Computers and/or Target Users:
    1. Go to Computers > Policies.
    2. Click + New.
    3. Click General in the left pane.
    4. Give the policy a name.
    5.  Select the following Trigger events that will initiate the policy:
      • Enrollment Complete – the script runs immediately after devices complete the enrollment process.
      • Recurring Check-in – the script runs according to the recurring check-in frequency configured in Jamf Pro.
    6. Set the Execution Frequency to Once per computer per user.

      Note: There are other approaches that you can implement in Jamf Pro to trigger deployment of the script (for example, Extension Attributes, which allow you to validate that the certificate is on the device and to deploy the certificate if it is missing).

    7. Click Scripts and add the script you created earlier to this policy.
    8. Click ScopeA scope is an indication by the client that it wants to access some resource..
    9. In Target Computers and/or Target Users, specify the computers and users to whom the policy will apply.
    10. Save the policy.
  6. (Recommended) To prevent iCloud from transferring the Okta keychain from Device Trust-secured macOS devices to other Apple devices, you should create a Configuration Profile in Jamf Pro that disables Allow iCloud Keychain syncing. ClosedScreenshot

  7. Check the log in Jamf Pro to verify that the Okta Device Registration Task ran successfully.
    1. Go to Policies and click your policy.
    2. Click Logs at the bottom of the screen.
  8. Proceed to Part Ⓓ.

ClosedPart Ⓓ — In Okta: Configure app Sign On policy rules in Okta

ClosedClick: Important to know before you begin

Overview

By default, all ClientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. options in the App Sign On Rule dialog box are pre-selected. Notice that the Trusted and Not trusted options in the Device Trust section are not selectable unless you deselect the following options in the Client section ClosedScreenshot:

  • Exchange ActiveSync or Legacy Auth client
  • Other mobile (e.g. BlackBerry)
  • Other desktop (e.g. Linux)

To configure more granular access to the app, selectively apply conditions as you create one or more prioritized rules based on:

  • Who users are and/or the groups to which they belong
  • Whether they are on or off network or within a defined network zone
  • The type of client running on their device (Office 365 apps only)
  • The platform of their mobile or desktop device
  • Whether or not their devices are Trusted
ClosedWhitelist approach to creating Sign On policy rules

Procedure

Note: This example shows Device Trust rules for managing access to Office 365. For other apps, note that the section If the user's client is any of these is not present.

  1. In Okta, go to Applications and click the SAML or WS-Fed-enabled app that you want to protect with Device Trust.
  2. Click the Sign On tab, scroll down to the Sign On Policy, and click Add Rule.
  3. Configure one or more rules using the following examples as a guide.

Whitelist example

ClosedExample Rule 1 – Exchange ActiveSync; All platforms; Any trust; Allow access

ClosedScreenshot

  1. Enter a descriptive name for the rule.

CONDITIONS

  1. Under People, specify whether to apply the rule to individuals only or to individuals and groups. The People option you select must be the same for all the rules you create for this example.
  2. Under Location, specify the user location to which the rule will apply. The Location option you select must be the same for all the rules you create for this example.
  3. Configure client settings:

    4. Type:

    ¨ Web browser or Modern Auth client is selected.

    þ Exchange ActiveSync client is is unselected.

    Mobile:

    þ iOS is selected.

    þ Android is selected.

    þ Other mobile is selected.

    Desktop:

    þ Windows is selected.

    þ macOS is selected.

    þ Other desktop is selected.

  4. Configure Device Trust.
    5. ClosedTip: To make Trusted and Not Trusted options selectable:

    Trusted and Not trusted options in the Device Trust section are selectable only when all of the following options in the Client section are not selected:

    • Exchange ActiveSync or Legacy Auth client
    • Other mobile (e.g. BlackBerry)
    • Other desktop (e.g. Linux)

    þ Any is selected.

    ¨ Trusted is unselected.

    ¨ Not trusted is unselected.

ACTIONS

  1. Configure Access:

    2. Allowed is selected.

    ¨ Prompt for factor is unselected.

  2. Click Save.
  3. Create Rule 2.
ClosedExample Rule 2 – Web browser or Modern Auth; macOS; Trusted; Allow access

ClosedScreenshot

  1. Enter a descriptive name for the rule.

CONDITIONS

  1. Under People, select the same People option that you selected in Rule 1. The People option must be the same for all rules in this example.
  2. Under Location, select the same Location option that you selected in Rule 1. The Location option must be the same for all rules in this example.
  3. Configure client settings:

    4. Type:

    þ Web browser or Modern Auth client selected.

    ¨ Exchange ActiveSync client is unselected.

    Mobile:

    ¨ iOS is unselected.

    ¨ Android is unselected.

    ¨ Other mobile is unselected.

    Desktop:

    ¨ Windows is unselected.

    þ macOS is selected.

    ¨ Other desktop is unselected

  4. Configure Device Trust.
    5. ClosedTip: To make Trusted and Not Trusted options selectable:

    Trusted and Not trusted options in the Device Trust section are selectable only when all of the following options in the Client section are not selected:

    • Exchange ActiveSync or Legacy Auth client
    • Other mobile (e.g. BlackBerry)
    • Other desktop (e.g. Linux)

    ¨ Any is unselected.

    þ Trusted is selected.

    ¨ Not trusted is unselected.

ACTIONS

  1. Configure Access.

    2. Allowed is selected.

    ¨ Prompt for factor is unselected.

  2. Click Save.
  3. Create Rule 3.
ClosedExample Rule 3 – Web browser or Modern Auth; All platforms except macOS; Any Trust; Allow access + MFA

ClosedScreenshot

  1. Enter a descriptive name for the rule.

CONDITIONS

  1. Under People, select the same People option that you selected in Rule 1. The People option you select must be the same for all rules you create for this example.
  2. Under Location, select the same Location option that you selected in Rule 1. The Location option you select must be the same for all rules you create for this example.
  3. Configure client settings:

    4. Type:

    þ Web browser or Modern Auth client selected.

    ¨ Exchange ActiveSync client is unselected.

    Mobile:

    ¨ iOS is unselected.

    þ Android is selected.

    þ Other mobile is selected.

    Desktop:

    þ Windows is selected.

    þ macOS is selected.

    þ Other desktop is selected.

  4. Configure Device Trust.
    5. ClosedTip: To make Trusted and Not Trusted options selectable:

    Trusted and Not trusted options in the Device Trust section are selectable only when all of the following options in the Client section are not selected:

    • Exchange ActiveSync or Legacy Auth client
    • Other mobile (e.g. BlackBerry)
    • Other desktop (e.g. Linux)

    þ Any is selected.

    ¨ Trusted is unselected.

    ¨ Not trusted is unselected.

ACTIONS

  1. Configure Access.

    2. Allowed is selected.

    þ Prompt for factor is selected.

  2. Click Save.
  3. Create Rule 4.
ClosedExample Rule 4 – Any client type; All platforms; Any Trust; Deny access

ClosedScreenshot

  1. Enter a descriptive name for the rule.

CONDITIONS

  1. Under People, select the same People option that you selected in Rule 1. The People option you select must be the same for all rules you create for this example.
  2. Under Location, select the same Location option that you selected in Rule 1. The Location option you select must be the same for all rules you create for this example.
  3. Configure client settings:

    4. Type:

    þ Web browser or Modern Auth client selected.

    þ Exchange ActiveSync client is selected.

    Mobile:

    þ iOS is selected.

    þ Android is selected.

    þ Other mobile is selected.

    Desktop:

    þ Windows is selected.

    þ macOS is selected.

    þ Other desktop is selected.

  4. Configure Device Trust.
    5. ClosedTip: To make Trusted and Not Trusted options selectable:

    Trusted and Not trusted options in the Device Trust section are selectable only when all of the following options in the Client section are not selected:

    • Exchange ActiveSync or Legacy Auth client
    • Other mobile (e.g. BlackBerry)
    • Other desktop (e.g. Linux)

    þ Any is selected.

    ¨ Trusted is unselected.

    ¨ Not trusted is unselected.

ACTIONS

  1. Configure Access.

    2. Denied is selected.

  2. Click Save.
ClosedRule 5 — Default sign on rule – Any client, All platforms; Any Trust; Allow access

The Default sign on rule is already created and cannot be edited. In this example, the Default rule is never reached because it is effectively negated by Rule 4.

ClosedScreenshot



ClosedPart Ⓔ — In Okta: Revoke and remove Device Trust certificates

You may need to revoke an end user's Device Trust certificate(s) from the Okta Certificate Authority. This is recommended if the computer is lost or stolen, or if the end user is deactivated. To re-secure an end user's computer with Device Trust after revoking their Device Trust certificate(s), you need to remove the revoked certificate from their computer before enrolling a new certificate.

ClosedClick: Important to know before you begin
  • Steps 1 - 4 of this procedure revoke all Device Trust certificates from the Okta Certificate Authority that were issued to the end user. Certificate revocation does not remove existing certificates from macOS computers. In order to re-secure a macOS computer with Device Trust after revoking certificates, you must first remove any existing Device Trust certificate from the computer and then re-enroll the computer with a new certificate as detailed in Step 5. The Device Registration Task will not enroll a new certificate if another certificate (whether revoked or not) is present on the computer.
  • When an end user is deactivated Okta also revokes their Device Trust certificate from the Okta Certificate Authority automatically (but does not remove the certificate from their computer). To remove the certificate from the computer, use either removal method described in Step 5.

  1. Go to Directories > People.

  2. Click the end user whose Device Trust certificate you want to revoke.

  3. In the More Actions menu, click Revoke Trust Certificate. ClosedScreenshot

  4. Read the message that displays, and then click Revoke Trust Certificate.

  5. To remove the Device Trust certificate for any reason (such as prior to re-securing a computer with Device Trust), first remove any existing Device Trust certificate from the computer. You can use a command line or create an uninstall script in Jamf Pro. Both uninstall methods remove all Device Trust related artifacts from the macOS device.

    6. Security best practice: If you plan to reuse the script that you downloaded and modified in Part Ⓑ, make sure to first remove the Org Token before using it. Also, the token is not necessary for the uninstall operation.

    • Remove through a command line — Open a terminal on the target computer and issue the command python <fileName>.py uninstall where <fileName> is the name of Okta Device Registration Task. For example, if the name of the Okta Registration Task is MacOktaDeviceRegistrationTaskSetup.1.0.2.py, you would issue this command:

      python MacOktaDeviceRegistrationTaskSetup.1.0.2.py uninstall

    • Remove with an uninstall script — Create an uninstall script in Jamf Pro configured to pass the uninstall parameter. For details, see the procedure Adding a Script to Jamf Pro in Jamf Pro documentation.

ClosedPart Ⓕ — In Jamf Pro and on macOS computers: View certificate enrollment logs (optional)

ClosedView logs in Jamf Pro

During deployment, the Okta Device Registration Task publishes logs in Jamf at three log levels (INFO, WARN, ERROR). To diagnose deployment issues, Jamf administrators can view deployment logs on a policy or individual computer basis. To generate more granular logs, use the verbose option as the Parameter Value in Jamf Pro. ClosedScreenshot

In addition, end users can view log messages on their local macOS computers by having the Console app open while the script runs on their computer.

ClosedView logs on macOS computers

You can watch and monitor Okta-related log messages during certificate enrollment. The method depends on the operating system running on the device.

If running version 10.11.6 (OS X El Capitan):

  1. Open Utilities > Console.
  2. Click All Messages.
  3. Type Okta in the search field and press Enter to filter all Okta-related messages.


If running either of these operating systems:

  • macOS 10.12.6 (Sierra)
  • macOS 10.13.4 (High Sierra)
  1. Open Utilities > Console.
  2. Click your device under Devices in the left pane.
  3. Type Okta in the search field and press Enter to filter all Okta-related messages.


To view past logs for all supported operating systems:

  1. Open Utilities > Console.
  2. Go to /var/log > asl in the left pane.
  3. Select the date you want to search on.
  4. Type Okta in the search field and press Enter to filter all Okta-related messages.


To see the system calls executed on the device, run the following command and then execute the Device Registration Task:

log stream --predicate 'eventMessage contains "okta"'

ClosedPart Ⓖ — In Jamf Pro: Modify the app whitelist (optional)

The Okta Device Registration Task whitelists some popular apps by default so that end users aren't prompted for the keychain password when trying to access them. You can customize the default whitelist as described in this procedure.


ClosedClick: Important to know before you begin
  • Best practice – Keep a copy of your preferred whitelist. Your modified whitelist is overwritten whenever you push a new Okta Device Registration Task to your targeted macOS computers, so you'll have to recreate it.
  • If you add apps to the original Okta-defined whitelist, you should consider testing your modified whitelist with a subset of users before rolling it out to all users.
  •  You can whitelist any SAML/WS-Fed-enabled app that supports authentication through a webview. The webview in which authentication is performed must have access to the Okta Keychain on the device. The original Okta-provided whitelist currently includes the following apps:
    • Box
    • Chrome
    • Safari
    • Microsoft Office
    • Skype for Business
    • Google Drive
    • Slack
  • Unlike TeamIdentifiers for the other whitelisted apps, the TeamIdentifier for Safari is simply apple: (notice the colon) without a teamid: prefix.

  1. Find the TeamIdentifier for the app(s) you want to whitelist:
    1. On a macOS device that has the apps you want to whitelist, open a command line and list the apps in the Applications folder:
      2. ls /Applications
    2. Find an app's TeamIdentifier:
      3. codesign -dv --verbose=4 /Applications/exampleapp.app

      where exampleapp is the app you are investigating.

    3. Locate the TeamIdentifier value in the output and make a note of it.

      4. For example, here's how to find the team TeamIdentifier for RingCentral:

      codesign -dv --verbose=4/App /Applications/RingCentral\ Meetings.app

      And here's the output:


  2. Modify the whitelist in the Okta Device Registration Task:

    3. Example before modification

    Whitelist includes the original Okta-defined whitelist:



    Example after modification

    Whitelist with RingCentral added:



  3. Save your changes.
  4. When appropriate, push the Okta Device Registration Task as described Part Ⓒ.

Best practice – Keep a copy of your preferred whitelist. Your modified whitelist is overwritten whenever you push a new Okta Device Registration Task to your targeted macOS computers, so you'll have to recreate it.


ClosedTroubleshooting

The Okta Device Registration Task is a python script that you obtain from Okta, modify, and then upload to Jamf Pro for distribution to the macOS devices you have targeted for this Device Trust solution. ClosedMore.

When deployed on the device, the Okta Device Registration Task does the following:

  • Registers with Okta to obtain a Device Trust certificate. Okta checks with Jamf Pro to make sure the device is managed.

  • Configures Chrome and Safari browsers and tested native appsThese Modern Auth-enabled native apps: Microsoft Office 365, Box, Google Drive, Skype for Business, Slack on the device to present the certificate automatically during secure app access.

  • Schedules a lightweight task that runs once a day and whenever users log in to their computer. The task checks whether the Device Trust certificate is expired and tries to renew the certificate 30 days before expiry. Certificates are valid for 1 year.

  • During renewal, Okta performs checks similar to those that occur during registration, such as checking whether the device is managed before issuing a new certificate.
  • After the script runs on the device once, Jamf Pro removes it from the device automatically.
  • You can use the following query to determine which version of the Registration Task is installed on the device:
    python ~/Library/Okta/okta_device_trust.py version

The two problems that you are most likely to encounter are:

  • Trusted devices are unable to access Device Trust-secured apps.
  • Untrusted devices are able to access Device Trust-secured apps.

If you encounter either problem, try to correct it by performing Basic Troubleshooting. If the problem persists, perform Advanced Troubleshooting.

ClosedBasic Troubleshooting

To perform basic troubleshooting, review the following areas:

ClosedEnablement

Verify the following:

  • This device trust feature is included in your org's version of Okta (your SKU)

    • — and —

  • You have enabled the global Device Trust setting in Security > Device Trust > Enable macOS Device Trust.
ClosedRegistration task

Verify that you have correctly configured Jamf Pro to distribute the Device Registration Task to targeted macOS devices as detailed in Part C.

You can use the following query to determine which version of the Registration Task is running on the device:

python ~/Library/Okta/okta_device_trust.py version

ClosedCertificate

Verify that the certificate is installed

Make sure that certificates are installed in the keychain on the devices you have targeted for this Device Trust solution. If certificates are not installed and the Trusted setting is enabled in your App Sign On Policy, users are denied access to the app and are redirected to a security message advising them to contact their administrator. (You can configure the message to include a Learn more link to more information. For details, see here).

ClosedTo verify installation from a terminal:

Show keychain info

security show-keychain-info okta.keychain

Show the certificate

security find-certificate -a -c 'Okta MTLS' -Z -p okta.keychain

Show the password

security find-generic-password -l device_trust -w

ClosedTo verify installation through the GUI on targeted devices:
  1. On the macOS device, search for Keychain Access.
  2. Double click to open the Keychain Access app.
  3. Verify that the Okta Keychain exists and that it includes the Okta MTLS certificate. ClosedScreenshot

    4. If either the Okta Keychain, the certificate, or the private key are missing, the registration task did not complete successfully. In this case, view logs in Jamf Pro.

  4. In the login keychain, verify that the device_trust password and identity preferences appear. ClosedScreenshot

    5. If the device_trust password is not present then device trust-secured apps cannot access the Okta keychain. To remedy, uninstall the certificate (see Part E) and then re-enroll the device (see Part C).

Maximum certificate enrollment limit

A certificate becomes bound to a given user the first time that user accesses a device trust-secured application from a device trust-secured macOS device. Unused certificates are unbound. Okta can issue up to five unbound certificates to the device, one each time you perform the enrollment procedure. As a security precaution, Okta will not issue more than five unbound certificates to a given device. To avoid reaching the unbound certificate limit, ensure that users use the unbound certificates already on the device before you attempt to obtain more certificates through enrollment. If you reach the enrollment limit, the Syslog indicates an enrollment failure and the error message Maximum enrollment limit of 5 certificates for a device is reached appears in the JAMF log.

Prevent an auth failure caused by blocked Mutual TLS certificate exchange

The Mutual TLS certificate exchange (handshake) in this Device Trust flow occurs on Okta URLs that are separate from your Okta org URL (indicated by the wildcard character (*) in the example below). If your org implements endpoint protection software, make sure to configure it in a way that does not block the Mutual TLS certificate exchange (handshake) that occurs during this Device Trust flow. For example, if your organization uses a whitelist to limit outbound traffic, add these exact URLs to the whitelist, including the wildcard character (*), as shown here:

*.okta.com

*.okta-emea.com

ClosedSign On Policy

Verify that you have configured a Sign On Policy that:

  • Is applied to the WS-Fed or SAML app(s) that you want to secure with Device Trust.
  • Is applied to the correct user(s) and/or groups.
  • Includes, at minimum, an Active rule that denies access to untrusted devices.
ClosedSystem Log

Verify Device Trust events

Review the System Log to verify the following Device Trust System Log events:

Authentication

  • DisplayMessage: Authentication of device via certificate
  • EventType: user.authentication.authenticate

Enrollment

  • DisplayMessage: Device Trust certificate enrollment
  • EventType: user.credential.enroll

Issuance

  • DisplayMessage: Device Trust certificate issuance
  • EventType: pki.cert.issue

Revocation

  • DisplayMessage: Device Trust certificate revocation
  • EventType: pki.cert.revoke

Renewal

  • DisplayMessage: Device Trust certificate renewal
  • EventType: pki.cert.renew

View unique device IDs in DebugContext

DebugData shows the unique ID of the devices associated with Device Trust events and is useful for debugging purposes. This information can also help you verify that Device Trust is being enforced on devices in your device inventory, which may be useful prior to rolling out the feature to a large group of users.

Important: The information contained in debugContext.debugData is intended to add context when troubleshooting customer platform issues. Note that key names and values are subject to change without notice and should be used primarily as a debugging aid, not as a data contract. For more about the DebugContext, see the DebugContext Object in Okta Developer documentation.

  1. In the Okta Admin Console, go to Reports > System Log.
  2. Search for the Device Trust Event (date) that you’re interested in, then navigate to:

    Event > AuthenticationContext > System > DebugContext > DebugData

ClosedVerify Jamf Pro setup
  • In the Okta Admin Console, are the Secret Key Value and the Org URL correctly populated in the Okta Device Registration Task (see Part B)?
  • Is the Okta Device Registration Task that you modified and added to Jamf Pro the latest version (see Version History)?
  • Do the trigger events in your Jamf Pro policy include Enrollment Complete and Recurring Check-in (see Part C)?
  • Have you viewed deployment logs (see Part F)?
  • Do Jamf Pro Policy Logs show that the script execution status is Completed? ClosedMore

ClosedAdvanced Troubleshooting

If Basic Troubleshooting did not resolve the problem you are experiencing, and the certificate is not installed on the macOS device, check in the following locations:

ClosedIn the Okta Admin app

Verify that the end user of the macOS device is present and Activated in Directory > People.

ClosedOn the macOS device

Confirm that auto certificate settings are configured in Chrome:

  1. In Chrome, enter chrome://policy in the address bar, and then press Enter.
  2. Click Show value and verify that the policy AutoSelectCertificateForUrls displays this value: 
    {"pattern":"https://[cell]-devicetrust.okta.com","filter":{"ISSUER":{"CN":"MTLS Certificate Authority”}}}

    3. -or-

    {"pattern":"https://[cell]-devicetrust.okta-emea.com","filter":{"ISSUER":{"CN":"MTLS Certificate Authority”}}}

    where [cell] is the cell where your Okta org resides as shown in the footer of your Okta Admin Console.

Verify that native apps are whitelisted in the keychain

Issue the following command to verify that whitelisted appsMicrosoft Office 365, Box, Google Drive, Skype for Business, Slack (Part G) can access the certificate: ClosedScreenshot

security dump-keychain -a okta.keychain

Validate remediation

Try to access a Device Trust-secured app from a browser or thick client. If an error displays while trying to access the app, Quit and Close the browser (Chrome or Safari), then relaunch the browser and try to access the app again.


ClosedCaveats
  • Modern Authentication required for securing Microsoft Office apps — To secure Microsoft Office apps with this Device Trust solution they must be enabled to support Modern Authentication. For more information, see this Microsoft article. For information about securing Office 365 clients that use legacy protocols, see Office 365 Client Access Policies.

  • Device Trust is not supported with all versions of Microsoft Office thick clients — This Device Trust solution has been tested to work with Microsoft Office thick client versions 16.13.1 and 16.15. However, it does not work with Microsoft Office thick client version 16.14 (build 180610).

  • Prevent iCloud from transferring the Okta keychain to other Apple devices — To prevent iCloud from transferring the Okta keychain from DT-secured macOS devices to other Apple devices, Okta strongly recommends that you create a Configuration Profile in Jamf Pro that disables Allow iCloud Keychain syncing. (Note: Be aware that disabling syncing blocks all keychain transfers.) For details, see the Jamf Pro procedure in Part C.

  • Webview must have access to the device keychain — Device Trust for managed macOS computers works with any SAML/WS-Fed-enabled app that supports authentication through a webview. The webview in which authentication is performed must have access to the Okta Keychain on the device. To prevent end users from being prompted for consent when the certificate is used in the authentication flow, Okta whitelists the following apps (To modify the default whitelist, see Part G: Modify the default whitelist (optional)):

    • Box
    • Chrome
    • Safari
    • Microsoft Office
    • Skype for Business
    • Google Drive
    • Slack
  • Per-device unbound certificate limit — A certificate becomes bound to a given user the first time that user accesses a device trust-secured application from a device trust-secured macOS device. Unused certificates are unbound. Okta can issue up to five unbound certificates to the device, one each time you perform the enrollment procedure. As a security precaution, Okta will not issue more than five unbound certificates to a given device. To avoid reaching the unbound certificate limit, ensure that users use the unbound certificates already on the device before you attempt to obtain more certificates through enrollment. If you reach the enrollment limit, the Syslog indicates an enrollment failure and the error message Maximum enrollment limit of 5 certificates for a device is reached appears in the JAMF log.
  • Per-org enrollment limit — A given macOS device can only be secured by the Device Trust configuration of a single Okta org. Put another way, macOS devices cannot be secured by the Device Trust configuration of multiple Okta orgs simultaneously. This is because the client certificate issued to the device is signed by the CA of a particular org. This limit applies to Okta Preview and Production orgs.

  • Ensure clients can complete the MTLS handshake — If your org implements endpoint protection software, make sure to configure it in a way that does not block the Mutual TLS certificate exchange (handshake) that occurs during this Device Trust flow. For details, see Prerequisites.

  • Shared-terminal scenarios are not supported — This Device Trust solution does not support shared-terminal scenarios in which multiple Okta end users log in to the same account from the same macOS workstation.
  • Device Trust enrollment not supported when Okta is read-only mode — Devices that you have targeted for this Device Trust solution cannot be enrolled in Device Trust if the cell in which your Okta org resides is in read-only modeA mode during which most administrative operations are disabled and a banner is displayed in the admin (not end-user) Dashboard. During read-only mode, all background jobs such as imports, OMM enrollment, OMM deprovisioning, and JIT provisioning are queued, and all are restarted when read-only mode is disabled..
  • End users may need to clear the browser cache — Some browsers (for example, Chrome) cache the Device Trust certificate. After the certificate is renewed automatically (once per year), these browsers may continue to present the expired certificate to Okta instead of the new certificate. In that case, end users are shown the Security requirements message and are denied access to Device Trust-secured apps. Okta recommends that you advise affected end users to clear browser cache by quitting and then restarting the browser (not just closing the browser window).

    • Device Trust-secured apps are shown as locked on end-user Okta Home pages — End-user Okta Home pages viewed on desktop and mobile browsers (but not in Okta Mobile) display a lock icon on all Device Trust-secured app icons if :

    (1) Device Trust is enabled for the org, and . . .

    (2) The device is not trusted, and . . .

    (3) The end user tried to access any Device Trust-secured app from their Home page.

    The lock icon remains for the duration of the session.


ClosedKnown Issues
  • Security requirements page not shown when accessing O365 native apps — End users with unmanaged macOS devices are not shown the Security requirements page when they try to access Office O365 native apps secured by this Device Trust solution. (This problem occurs only with Office Native apps; it does not occur when trying to access O365 apps through desktop browsers like Chrome and Safari.) ClosedScreenshot

  • Problem accessing Google Backup and Sync app — When signing in to the Backup and Sync app (part of Google Drive), the authentication flow stops on the Google Account page instead of progressing to the app. Google is aware of this issue. To complete signing in, click the Sign in with your browser instead link in the lower portion of the page.

ClosedRelated topics

From Okta

Device Trust

Device Trust for macOS Registration Task Version History

Office 365 Client Access Policies

Configuring Microsoft Exchange ActiveSync (EAS)


External resources

Microsoft

How modern authentication works for Office 2013 and Office 2016 client apps

Office 365: Enable Modern Authentication

Updated Office 365 modern authentication

Office 2013 and Office 365 ProPlus modern authentication and client access filtering policies


Jamf Pro

Computer Extension Attributes

Introduction to Extension Attributes (video)

Managing Scripts

QuickStart Guide for Managing Computers 10.4.0

QuickStart Guide for Managing Mobile Devices 10.4.0

Jamf Pro Installation and Configuration Guide for Mac 10.4.0

Jamf Pro Administrator's Guide 10.4.0

Top

© 2020 Okta, Inc All Rights Reserved. Various trademarks held by their respective owners.