Description
Some Okta tenants won't accept the certificate format Jamf Account provides when using a Private Key JWT instead of a Client Secret. In these cases, you'll need to retrieve the JSON Web Key Set (JWKS) that was provided to the Okta team so you can share or verify it directly.
Tip: Use Chrome to Pretty-print the JSON, or open the result in BBEdit and tidy the JSON, so it's easier to read.
Retrieving OIDC Private Key JWT
Create the OIDC connector in Jamf Account. Set this up as you normally would before continuing.
Get the connectionName. In a browser, go to the following URL, replacing the domain with your domain:
https://org-region-service.jamf.com/v2/region/domain/customerdomainname.comThis returns a JSON response similar to the example below. Locate the
connectionNamefield:{
"domain": "domain.com",
"orgId": "org_redacted",
"connections": [
{
"connectionId": "con_redacted",
"connectionName": "displayname-redacted",
"displayName": "displayname",
"connectionType": "OKTA",
"tenant": "us",
"domain": "domain.com",
"tenantUrl": "https://us.auth.jamf.com/",
"orgId": "org_redacted",
"enabledProducts": [],
"enabledEnvironments": [],
"logoUrl": "https://account-cdn.jamf.com/25.10.2/assets/custom-icons/okta.svg"
}
],
"displayName": "displayname",
"jamfIdDisabled": false
}Get the private key in JSON format. Take the
connectionNamevalue from step 2 and use it in the following URL, replacingdisplayName-redactedwith the actualconnectionName:https://jamf-auth.us.auth0.com/oauth/connection/displayName-redacted/.well-known/jwks.json
Review the result. This displays the key information that was provided to the Okta team. For example:
{
"keys": [
{
"kid": "redacted",
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"n": "redacted",
"e": "AQAB"
},
{
"kid": "redacted",
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"n": "redacted",
"e": "AQAB"
}
]
}