Description
When a device is off-site and has VPN turned off, the device is unable to pass the required trusted device certificate in Jamf Connect's menu bar change password window.
Because the device is off-site and VPN turned off, the Jamf Connect window can not connect to kerberos and defaults the pop up window to the web based sign-in. The web based sign-in window uses Okta API to complete sign in which cannot pass MFA options such as a trusted device certificate.
Note - In this article, Jamf Connect menu bar refers to settings configured with the com.jamf.connect preference domain. It applies to Jamf Connect menu bar versions 2.x and could apply to the Self Service+ menu bar and/or Self Service+ Account management dashboard as well.
Create a Jamf Connect Actions Configuration Profile
Utilize Jamf Connect's Actions domain:
In Jamf Pro go to Computers > Configuration Profile > +New.
Give a display name and configure the General tab as needed.
Find and select the Applications & Custom App Settings > Upload, select +Add.
Configure the following:
Preference Domain:
com.jamf.connect.actionsProperty List:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Version</key>
<integer>1</integer>
<key>MenuIcon</key>
<true/>
<key>Actions</key>
<array>
<dict>
<key>Name</key>
<string>Rest Password No VPN</string>
<key>Action</key>
<array>
<dict>
<key>Command</key>
<string>url</string>
<key>CommandOptions</key>
<string>{oktaResetPasswordURL}</string>
</dict>
</array>
<key>Post</key>
<array>
<dict>
<key>Command</key>
<string>alert</string>
<key>CommandOptions</key>
<string>WARNING: Once you have changed your password don't forget to come back to the Jamf Connect Menubar and select "Connect...". If skipped, on next login, you'll need your old password.</string>
</dict>
</array>
</dict>
</array>
</dict>
</plist>Replace {oktaResetPasswordURL} with the URL to reset your password. (Optionally you can run the Self Service policy using the following workflow: https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Jamf_Self_Service_for_macOS_URL_Schemes.html
Click Scope and add a test computer to the scope of the profile.
Click Save.
Find your Jamf Connect menu bar profile and add the Custom Menu Item Preferences key:
Actions.This can be named to whatever you would like: "Actions", "Reset Password No VPN", etc. Example:
<key>CustomMenuItems</key>
<dict>
<key>Actions</key>
<string>Reset Password No VPN</string>
</dict>To only show the reset password option if VPN is off, use the Show array.