LogoLogo
LogoLogo
  • Welcome
  • Details
  • Editions
  • Use Cases
  • SCEPMAN Deployment
    • Getting Started
      • Standard Guide
      • Extended Guide
    • Permissions
      • Azure App Registration
      • Managed Identities
    • Deployment Options
      • Marketplace deployment
      • Enterprise deployment
      • Terraform deployment
    • Root CA
    • Intermediate CA
  • Certificate Management
    • Revocation
    • Microsoft Intune
      • Windows
        • Certificate Based Authentication for RDP
      • macOS
      • Android
      • iOS/iPadOS
      • Linux
    • Jamf Pro
      • General Configuration
      • Computers
      • Devices
      • Users
    • Other MDM Solutions
      • Google Workspace
        • ChromeOS
      • Kandji
      • Mosyle
      • SOTI MobiControl
    • Certificate Master
      • Manage Certificates
      • Certificate Signing Request (CSR)
      • TLS Server Certificate
      • Sub CA Certificate
      • Code Signing Certificate
      • Client Certificate
      • User Certificate
    • Domain Controller Certificates
    • Enrollment REST API
      • Self Service Enrollment
        • Intune Managed Linux Client
        • Unmanaged Linux Client
      • API Enrollment
        • Linux Server
        • Windows Server
      • SCEPmanClient
  • Azure Configuration
    • Application Insights
    • App Service Sizing
      • Autoscaling
    • Custom Domain
    • Geo-Redundancy
    • Health Check
      • Using 3rd Party Monitoring
    • Log Management
    • Moving Resources
    • Private Endpoints
    • Split-Tenancy
  • Update Strategy
  • SCEPman Configuration
    • SCEPman Settings
      • Basics
      • Certificates
      • Certificate Master
      • CRL
      • Dependencies (Azure Services)
        • Azure KeyVault
        • Logging
        • Microsoft Entra ID (Azure AD)
        • National Cloud Platforms
      • Enrollment REST API
      • OCSP
      • SCEP Endpoints
        • DC Validation
        • Intune Validation
        • Jamf Validation
        • Static Validation
        • Static-AAD Validation
    • Certificate Master Settings
      • Basics
      • Microsoft Entra ID (Azure AD)
      • Logging
      • National Cloud Platforms
    • Application Artifacts
    • Certificate Master RBAC
    • Device Directories
    • Intune Strong Mapping
  • Other
    • Security & Privacy
    • Support
    • Licensing
      • Azure Marketplace
    • FAQs
      • General
      • Certificate Connector
      • Network Access Controllers
      • Renewing SCEPman Root CA
    • Troubleshooting
      • Common Problems
      • Certifried Security Vulnerability
      • Cisco ISE Host Header Limitation
      • Intune service discovery API permissions
      • Re-enrollment trigger
  • Uninstallation
  • Change Log
  • Links
  • SCEPman Website
Powered by GitBook
On this page
  • AppConfig:JamfValidation:Enabled
  • AppConfig:JamfValidation:DefaultEkus
  • AppConfig:JamfValidation:DefaultKeyUsage
  • AppConfig:JamfValidation:RequestPassword
  • AppConfig:JamfValidation:ValidityPeriodDays
  • AppConfig:JamfValidation:URL
  • AppConfig:JamfValidation:ClientID
  • AppConfig:JamfValidation:ClientSecret
  • AppConfig:JamfValidation:APIUsername
  • AppConfig:JamfValidation:APIPassword
  • AppConfig:JamfValidation:EnableCertificateStorage

Was this helpful?

  1. SCEPman Configuration
  2. SCEPman Settings
  3. SCEP Endpoints

Jamf Validation

Last updated 25 days ago

Was this helpful?

These settings should only be applied to the SCEPman App Service, not the Certificate Master. Please refer to .

AppConfig:JamfValidation:Enabled

Linux: AppConfig__JamfValidation__Enabled

Value: true or false (default)

Description: This setting helps you to request certificates via the MDM system.

  • True: SCEPman listens at the additional SCEP server endpoint with the path /jamf. Use in conjunction with .

  • False (default): SCEPman does not issue certificates for Jamf.

AppConfig:JamfValidation:DefaultEkus

Linux: AppConfig__JamfValidation__DefaultEkus

Applicable to version 2.8 and above

Value: Oids of the extended key usages (EKUs) that are added to the certificate if the Jamf endpoint is used. The Oids are separated by a comma, semicolon, or space. The default is Client Authentication (1.3.6.1.5.5.7.3.2)

Description: If a certificate request does not contain any EKUs, SCEPman adds the EKUs defined in this setting to the certificate. If is set to false, the EKUs defined in this setting will be added to the certificate even if the certificate request contains EKUs.

AppConfig:JamfValidation:DefaultKeyUsage

Linux: AppConfig__JamfValidation__DefaultKeyUsage

Applicable to version 2.8 and above

Value: EncipherOnly|CrlSign|KeyCertSign|KeyAgreement|DataEncipherment|KeyEncipherment|NonRepudiation|DigitalSignature|DecipherOnly (defaults are in italic)

AppConfig:JamfValidation:RequestPassword

Linux: AppConfig__JamfValidation__RequestPassword

Value: String

We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--JamfValidation--RequestPassword.

AppConfig:JamfValidation:ValidityPeriodDays

Linux: AppConfig__JamfValidation__ValidityPeriodDays

Value: Positive Integer

AppConfig:JamfValidation:URL

Linux: AppConfig__JamfValidation__URL

Value: String

Description: The root URL of your Jamf instance. E.g. https://your-instance.jamfcloud.com/.

Jamf instances with customer URLs and ports may be added e.g. https://jamf.yourdomain.com:1234

AppConfig:JamfValidation:ClientID

Linux: AppConfig__JamfValidation__ClientID

Applicable to version 2.9 and above

Value: String

Description: ClientID and ClientSecret are an alternative to APIUsername and APIPassword.

  • Read Mobile Devices

  • Read Computers

  • Read User

AppConfig:JamfValidation:ClientSecret

Linux: AppConfig__JamfValidation__ClientSecret

Applicable to version 2.9 and above

Value: String

We recommend to define this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--JamfValidation--ClientSecret.

If you set this setting as a Secret in the Key Vault, you do not need to add the AppConfig:JamfValidation:ClientSecret to the SCEPman configuration anymore.

AppConfig:JamfValidation:APIUsername

Linux: AppConfig__JamfValidation__APIUsername

Value: String

Description: Either use this and APIPassword or ClientID and ClientSecret. The name of a service account in Jamf that SCEPman uses to authenticate on your Jamf instance. SCEPman needs the following permissions to query for computers, devices, and users:

  • Computers -> Read

  • Mobile Devices -> Read

  • Users -> Read

AppConfig:JamfValidation:APIPassword

Linux: AppConfig__JamfValidation__APIPassword

Value: String

We recommend defining this setting as Secret in Azure Key Vault. The Secret must have the name AppConfig--JamfValidation--APIPassword.

If you set this setting as a Secret in the Key Vault, you do not need to add the AppConfig:JamfValidation:APIPassword to the SCEPman configuration anymore.

AppConfig:JamfValidation:EnableCertificateStorage

Linux: AppConfig__JamfValidation__EnableCertificateStorage

Applicable to version 2.3 and above

SCEPman Enterprise Edition only

Value: true or false (default)

Description: If a certificate request does not contain a Key Usage, SCEPman adds the Key Usage defined in this setting to the certificate. If is set to false, the Key Usage defined in this setting will be added to the certificate even if the certificate request contains a Key Usage.

Description: A challenge password (max 32 characters) that Jamf must include in every SCEP request to acquire a certificate. Only used if is set to true.

Description: This setting further reduces the global for the Jamf endpoint.

Enter the Client ID of an API Client matching the Client Secret configured in the setting. on how to create an API Role and API Client. The API Client must have a role with these permissions:

Description: The Client Secret value for the API Client configuration in .

Description: The password of the service account configured in .

Description: When requesting certificates via the Jamf endpoint, SCEPman stores those requested certificates in the Storage Account in Azure if this is set to true. This will make the issued certificates appear in SCEPman Certificate Master, where you can view and revoke them manually. Additionally, certificates are revoked automatically if the corresponding Jamf object is deleted. If set to false, SCEPman will not store issued certificates and the certificates are visible only in the logs or if the SCEP client stores them somewhere. If this is not set, the behavior depends on the global setting .

AppConfig:JamfValidation:Enabled
Refer to the Jamf documentation
AppConfig:JamfValidation:ClientSecret
AppConfig:JamfValidation:ClientID
AppConfig:JamfValidation:APIUsername
SCEPman Settings
Jamf
AppConfig:JamfValidation:RequestPassword
AppConfig:UseRequestedKeyUsages
AppConfig:UseRequestedKeyUsages
ValidityPeriodDays
AppConfig:EnableCertificateStorage