Security

Hello there..

We've been using Jamf Pro as just a context server. It's been working properly until recently. My understanding is once they stopped allowing basic user authentication, you could enable bearer token authentication to continue using the user account in Jamf.

But, enabling this, results in several error messages per SECOND showing under Events:

"Failed to fetch Endpoint details from jss.pds.org Error code: 401 Verify Proxy settings, Server credentials and retry."

Have a case with TAC, but the first thing they said is that Clearpass doesn't support OAUTH authentication, even though this is an option - TAC first line of support recently leaves a lot to be desired to be honest..

Any ideas?

If you don't get a proper answer from first line: escalate the ticket.

And it may help to not provide a semi-solution, like using OAUTH and you may get the response that it's not supported. Just ask them to solve the issue with the JAMF integration, so the 401 errors that you see in the logs. There must be other users with the same issue, if JAMF stopped supporting the authentication that the extension uses; so escalate as much as possible till you have an answer; this may need engineering work and for that reason it's important to get this to engineering rather sooner than later (if it's not a config error from your side).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Aug 27, 2024 09:51 AM
From: su_A_ve
Subject: Jamf Pro context server - Bearer token authentication?

Hello there..

We've been using Jamf Pro as just a context server. It's been working properly until recently. My understanding is once they stopped allowing basic user authentication, you could enable bearer token authentication to continue using the user account in Jamf.

But, enabling this, results in several error messages per SECOND showing under Events:

"Failed to fetch Endpoint details from jss.pds.org Error code: 401 Verify Proxy settings, Server credentials and retry."

Have a case with TAC, but the first thing they said is that Clearpass doesn't support OAUTH authentication, even though this is an option - TAC first line of support recently leaves a lot to be desired to be honest..

Any ideas?

------------------------------
---
°(((=((===°°°(((=================================
------------------------------

I did an internal call, and apparently it's expected that the JAMF context servers don't work; and you should use the Extension instead. There is a tech note on the JAMF Pro extension here.

Can you try that?

Update: Bearer token should work with the standard context server, for OAuth use the extension.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Aug 28, 2024 11:16 AM
From: Herman Robers
Subject: Jamf Pro context server - Bearer token authentication?

If you don't get a proper answer from first line: escalate the ticket.

And it may help to not provide a semi-solution, like using OAUTH and you may get the response that it's not supported. Just ask them to solve the issue with the JAMF integration, so the 401 errors that you see in the logs. There must be other users with the same issue, if JAMF stopped supporting the authentication that the extension uses; so escalate as much as possible till you have an answer; this may need engineering work and for that reason it's important to get this to engineering rather sooner than later (if it's not a config error from your side).

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Aug 27, 2024 09:51 AM
From: su_A_ve
Subject: Jamf Pro context server - Bearer token authentication?

Hello there..

We've been using Jamf Pro as just a context server. It's been working properly until recently. My understanding is once they stopped allowing basic user authentication, you could enable bearer token authentication to continue using the user account in Jamf.

But, enabling this, results in several error messages per SECOND showing under Events:

"Failed to fetch Endpoint details from jss.pds.org Error code: 401 Verify Proxy settings, Server credentials and retry."

Have a case with TAC, but the first thing they said is that Clearpass doesn't support OAUTH authentication, even though this is an option - TAC first line of support recently leaves a lot to be desired to be honest..

Any ideas?

------------------------------
---
°(((=((===°°°(((=================================
------------------------------

Hello there..

We've been using Jamf Pro as just a context server. It's been working properly until recently. My understanding is once they stopped allowing basic user authentication, you could enable bearer token authentication to continue using the user account in Jamf.

But, enabling this, results in several error messages per SECOND showing under Events:

"Failed to fetch Endpoint details from jss.pds.org Error code: 401 Verify Proxy settings, Server credentials and retry."

Have a case with TAC, but the first thing they said is that Clearpass doesn't support OAUTH authentication, even though this is an option - TAC first line of support recently leaves a lot to be desired to be honest..

Any ideas?

I'm in the same boat. JAMF upgraded and removed basic auth. 
Enabling bearer token authentication is just returning the error posted by OP (su_A_ve). 

I have never worked with JAMF extension before.
Is the original JAMF connector in ClearPass broke and needs update? I'm in CP-6.11.9

Any update will be helpful.

Hello there..

We've been using Jamf Pro as just a context server. It's been working properly until recently. My understanding is once they stopped allowing basic user authentication, you could enable bearer token authentication to continue using the user account in Jamf.

But, enabling this, results in several error messages per SECOND showing under Events:

"Failed to fetch Endpoint details from jss.pds.org Error code: 401 Verify Proxy settings, Server credentials and retry."

Have a case with TAC, but the first thing they said is that Clearpass doesn't support OAUTH authentication, even though this is an option - TAC first line of support recently leaves a lot to be desired to be honest..

Any ideas?