pbowden-msft / signinhelper Goto Github PK

Does this work with Kandji?

Hi,

Thanks, it's work nice, but have you planed to integrate the login information aka Emai address for Teams ?

Regards,
Cedric

Hi,

your script runs a python2 command on line 66. Can you update to an alternative so that this will still work when monterey 12.3 comes around without python2 bundled in?

Thanks,

Elliot

Hey,

This didnt work with Jamf Connect 2.0 I updated your script with the following:

After line 267 -

# Detect Jamf Connect presence
DetectJamfConnect() {
	JAMFC=$(${CMD_PREFIX} /usr/bin/defaults read com.jamf.connect.state 2> /dev/null)
	if [ "$JAMFC" = "" ]; then
		echo "0"
	else
		echo "1"
	fi
}
# Get the DisplayName from Jamf Connects preference cache
GetDisplayNamefromJamfConnect() {
	JCDISPLAYNAME=$(${CMD_PREFIX} /usr/bin/defaults read com.jamf.connect.state DisplayName 2> /dev/null)
	if [ "$JCDISPLAYNAME" = "" ]; then
		echo "0"
	else
		echo "$JCDISPLAYNAME"
	fi
}

After line 379

JC=$(DetectJamfConnect)
if [ "$JC" = "1" ]; then
	echo ">>INFO - Detected that this machine is running Jamf Connect"
fi

After line 457

# Check Jamf Connect for Display Name
if [ "$UPN" = "0" ] && [ "$JC" = "1" ]; then
	UPN=$(GetDisplayNamefromJamfConnect)
	if [ ! "$UPN" = "0" ]; then
		echo ">>INFO - Found UPN under DisplayName from Jamf Connect: $UPN"
		SetPrefill "$UPN"
		exit 0
	else
		echo ">>WARNING - Could not retrieve UPN from Jamf Connect"
	fi
fi

I was wondering if I could do a API call to jamf to get the username in user location field for the Mac and add on the @mydomain.com to generate the UPN. Do you think this will work?

I kept getting the error: >>WARNING - Could not retrieve naming context

ERROR - Could not detect UPN.

After looking through the script, I found that if Enterprise Connect was Detected, there was no function to find the UPN. So I added the following function and if statement to the main process. It is working now.

Line 238:

Get the UPN from Enterprise Connect

function GetUPNfromEnterpriseConnect {
local ECUPN=$(${CMD_PREFIX} "/Applications/Enterprise Connect.app/Contents/SharedSupport/eccl" -a userPrincipalName | awk '/userPrincipalName:/{print $NF}' 2> /dev/null)
if [ "$ECUPN" == "" ]; then
echo "0"
else
echo "$ECUPN"
fi
}

and Line 342:

If we haven't got a UPN yet, see if we can get it from Enterprise Connect

if [ "$UPN" == "0" ] && [ "$EC" == "1" ]; then
UPN=$(GetUPNfromEnterpriseConnect)
if [ ! "$UPN" == "0" ]; then
echo ">>INFO - Found UPN from Enterprise Connect: $UPN"
SetPrefill "$UPN"
exit 0
else
echo ">>WARNING - Could not retrieve UPN from Enterprise Connect"
fi
fi

Hi Paul!

So tregerl on macadmin slack found this. When you run your script from Jamf via a policy, it runs in a non user context thus things like klist commands fail to work as expected. The cure is very simple thankfully.

After L41 where you detect the user, insert the following:
local LOGGEDINID=$(id -u $LOGGEDIN)

Now change your various klist lines so they have launchctl runas $LOGGEDIN
e.g.
local KERB=$(${CMD_PREFIX} launchctl asuser $LOGGINID /usr/bin/klist 2> /dev/null)

Looking at the code, I see that this supports Enterprise Connect. With EC being deprecated in favor of the native Kerberos SSO option, is it possible that this script will be updated to support that as well?