This is a simple tutorial on how to connect Jamf Pro to an Active Directory Domain Controller to authenticate users via Secure LDAP.

This is written using Jamf documentation here, https://docs.jamf.com/technical-articles/Configuring_Jamf_Pro_to_Use_LDAP_Over_SSL_When_Authenticating_with_Active_Directory.html , but with better explanations and not outsourcing most of the steps to Microsoft documentation.

---

Jamf Pro LDAP Mappings

These LDAP mappings should work for most cases. You may have to fine tune for your environment. Replace the Search Base with your own domain name.

User Mappings

Jamf Pro Attribute	User Object User Interface Mapping
Object Class Limitation	All ObjectClass Values
Object Class(Es)	organizationalPerson, user
Search Base	DC=your,DC=domain,DC=com
Search Scope	All Subtrees
User ID	uSNCreated
Username*	sAMAccountname OR userPrincipalName
Real Name	displayName
Email Address	userPrincipalName
Append To Email Results**
Department	department
Building	physicalDeliveryOfficeName
Room	streetAddress
Phone	telephoneNumber
Position	title
User UUID	objectGUID

User Group Mappings

Jamf Pro Attribute	Group Object User Interface Mapping
Object Class Limitation	All ObjectClass Values
Object Class(Es)	group, top
Search Base	DC=your,DC=domain,DC=com
Search Scope	All Subtrees
Group ID	uSNCreated
Group Name	name
Group UUID	objectGUID

User Group Membership Mappings

Jamf Pro Attribute	User Object User Interface Mapping
Membership Location	User Object
Group Membership Mapping	memberOf
Append To Username When Searching*
Use distinguished name of user groups when searching	Selected
Use recursive group searches	Selected

---

Prerequisites

1. An Active Directory Domain Controller.
2. An Active Directory Certificate Authority.
3. A Jamf Pro server that can communicate with the domain controller OR an externally facing JIM instance.

---

Creating the LDAP Service Account

1. Connect to your Domain Controller.
2. Search Active Directory Users in the Windows Search box and open the program.

3. Double click on Managed Service Accounts.
4. Right click on an empty space and select New → User.

5. Enter in an appropriate first name, last name, and username, then click Next.

6. Enter an appropriate password, then deselect User must change password at next login and select Password never expires, then click Next.
   • Note: This is insecure, but it works for testing.
7. Click Finish.

---

Creating a certificate template to use for a Certificate Request.

1. Connect to your Certificate Authority or Domain Controller (depending on whether you have those separate or not).
2. Search certtmpl.msc in the Windows search box and run the program.

3. Right-click on Kerberos Authentication and then select Duplicate Template.

4. Go to the General tab and Enable publish certificate in Active Directory option. Make sure to name the template appropriately.

5. Go to the Request Handling Tab and Enable Allow private key to be exported option.

6. Go to the Subject Name tab and ensure that the subject name format uses the DNS Name option.

7. Click on Apply, then OK.
8. Search Certification Authority in the Windows search box and open the program.

9. Right click on Certificate Templates and select New → Certificate Template to Issue.

10. Select your recently created Certificate Template and click OK.

11. If you are using an issuing CA, make sure to enable this on your intermediate and/or root CA as well.

---

Generating the LDAP client certificate

1. Connect to your Domain Controller.
2. Search mmc.msc (or mmc) in the Windows search box and run the program.

3. Click on File → Add/Remove snap-in.

4. Select Certificates, and click the Add button.

5. Choose Computer Account on the pop-up and then click Next.

6. Ensure Local Computer is selected, then click Finish, then OK.
7. Double click Certificates (local computer) → Personal → Certificates.

8. Right click on an empty space, then select All Tasks → Request New Certificate.

9. Click Next at the Before you Begin screen.
10. Click Next at the Select Certificate Enrollment Policy screen.
11. Select your Certificate Template at the Request Certificates screen.

12. Click Finish at the Certificate Installation Results.

---

Export the new LDAPS certificate

1. Right click on recently generated certificate and select All tasks → Export.

2. Click Next on the first screen.
3. Choose No, do not export the private key, then click Next.

4. Choose Base-64 encoded x.509 (.CER), then click Next.

5. Choose a location to save the certificate, like your Desktop, then click Next.
6. Click Finish.

---

Install Jamf Pro CA Certificate to the Domain Controller Trusted Root Certificate Store

1. Log into your Jamf Pro from your Windows Server.
2. Navigate to Settings → Global Settings → PKI Certificates → Management Certificate Template.

3. Click Download CA Certificate.
4. Navigate back to the MMC Certificates Console, right click on Trusted Root Certification Authorities → Import.

5. Click Next on the first screen.
6. Click Browse and navigate to your downloads folder.
7. Click the dropdown next to the filename field that says X.509 Certificate and change to All Files.
8. Select your Jamf Pro CA certificate and click Open.

9. Click Next to advance through the Certificate Store screen.
10. Click Finish to complete the import.

11. Restart your domain controller.

---

Connect Jamf Pro to LDAPS

1. Log into your Jamf Pro server from your Domain Controller, then navigate to Settings → LDAP Servers.

2. Click New.
3. Choose Configure Manually.

4. Enter a descriptive display name.
5. Ensure Microsoft’s Active Directory is chosen as the Directory Service.
6. Select Use SSL.
7. Enter in the Fully Qualified Domain Name (FQDN) of your Active Directory Domain Controller or load balancer.
   • FQDN is sometimes also called DNS name.
8. Upload your LDAPS certificate generated in the previous steps.
9. Optionally, enter your LDAP Proxy Server and port (Jamf Infrastructure Manager).
10. Choose Simple under the Authentication Type drop down.
11. Enter the Distinguished Name of your LDAP service account.
    • For example: CN=Jamf Pro Connector,CN=Managed Service Accounts,DC=rubyraccoon,DC=net
      • The first CN= wants the users Common Name (Full first and last name of the user)
      • The second CN= wants the type of account (User vs Managed Service Accounts)
      • The first DC= wants the domain name without the Top Level Domain (TLD)
      • The second DC= wants the TLD.
      • EG: Jamf Pro Connector, part of Managed Service Accounts, under the rubyraccoon.net domain.
    • This could also look like: CN=Jamf Pro Connector,CN=Managed Service Accounts,DC=ad,DC=rubyraccoon,DC=net
      • EG: Jamf Pro Connector, part of Managed Service Accounts, under the ad.rubyraccoon.net domain.
12. Enter and confirm the password for the service account.

13. Save the configuration.
    • If it fails to save, it’s either an issue with the FQDN/DNS Name, the LDAPS certificate, or the Service Account permissions/password.
14. Edit the configuration once more, then choose Mappings.
15. Fill out the mappings per Jamf documentation here, https://docs.jamf.com/technical-articles/LDAP_Attribute_Mappings_Reference.html .

---

Testing LDAP lookups

1. Click Test after configuring LDAPS per the instructions above.
2. Search for your Active Directory Username.
3. Click User Group Membership and search for your username and a group you know you should be a part of.

Congratulations! You’ve now configured Jamf Pro with a Secure LDAP Server!