topic Re: Cloudpath Enrollment System SCEP integration with JAMF in RUCKUS Self-Help

Cloudpath Enrollment System SCEP integration with JAMF

vijaykuniyal — Thu, 27 Apr 2023 22:18:04 GMT

This article explains setting up a Cloudpath Enrollment System SCEP integration with JAMF for Apple device management.

Table of Contents

Cloudpath Configuration
JAMF Configuration
>CONFIGURATION PROFILE
>SCEP SETTING
>CERTIFICATE SETTING
>NETWORK SETTING

NOTE: JAMF User and user group mapping has not been covered in this module.

Cloudpath Configuration

Create a SCEP Key

In the Cloudpath admin user interface, go to Certificate Authority>>> Manage Templates, then select the Certificate Template that will be used to issue the user/device certificates to the JAMF managed devices. Click on the “Manage” icon for the certificate template.

Select the SCEP Keys tab and under SCEP Keys , click on the “Add SCEP Key” button.

In the “Create SCEP Key” page, set a display name and description for the SCEP key. Set an expiration date if required. Select “Require Challenge Password” and enter password. Leave the Configuration Information section at the default settings. Click Save.

Back in the SCEP Keys tab of the certificate template, click on the “Show” icon under SCEP Enroll URL column.

This will reveal the full SCEP Key URL. Copy the full SCEP Enroll URL to a text editor (Notepad) for later use.

Root CA and Intermediate CA Export

The Root CA will be used in a later step to create a Trusted Certificate profile in JAMF.
To export the CA certificate, go to Certificate Authority>>>Manage CAs. Expand the Root section.

In the Public Key section, click on the “Download PEM” button. This will download a Base64 encoded DER file.

Perform the same steps for the Intermediate CA certificate

Get OCSP hash from Intermediate CA, it will be used in JAMF config later.

JAMF Configuration

CONFIGURATION PROFILES
Login into JAMF select Configuration Profiles>>>>New

Name: Name the profile and Save.

Under New configuration profiles

SCEP SETTING
SCEP>>>Configure SCEP.

URL: SCEP url copied earlier from Cloudpath SCEP profile created earlier.
Subject: CN=$DEVICENAME for IOS
Subject: CN=$COMPUTERNAME for OSX

Challenge and Verify Challenge: From Cloudpath SCEP Profile
Retires: 2
Retry Delay: 3

Key Size: 2048
Fingerprint: OCSP Hash from Cloudpath Intermediate CA

CERTIFICATE SETTING
Select Certificate>>>Configure Certificate

Import Root CA

Upload Root cert downloaded earlier from Cloudpath.

Click on + to add more cert.

Import Intermediate CA

Upload Intermediate cert downloaded earlier from Cloudpath.

NETWORK SETTING
Network >>>Configure Network>>>Configure

Service Set Identifier(SSID😞 Name of the SSID

Security Type: WPA2 Enterprise
Accepted EAP Types: TLS

Select TRUST tab as shown in this screenshot.

Identity Certificate: Select SCEP profile created earlier.
Trusted Certificates: Select Root CA and Intermediate CA.

Re: Cloudpath Enrollment System SCEP integration with JAMF

froi_borja_ama — Wed, 01 Feb 2023 05:54:56 GMT

Hi Vijay,

Currently we do not see the option for the trusted certificates box on our jamf pro upon doing the instructions on the last image. We are currently using Jamf Pro version 10.42.1-t1667311080. Will this affect the expected output?

Re: Cloudpath Enrollment System SCEP integration with JAMF

vijaykuniyal — Wed, 01 Feb 2023 17:47:21 GMT

Hi @froi_borja_ama,

I have added 1 more screenshot before the last image, hope that will help.

Re: Cloudpath Enrollment System SCEP integration with JAMF

froi_borja_ama — Mon, 27 Feb 2023 05:12:58 GMT

Hi Vijay

For the CN, can we use other format that gets the username instead of the text $DEVICENAME. Please see screenshot below for reference.

Re: Cloudpath Enrollment System SCEP integration with JAMF

vijaykuniyal — Mon, 27 Feb 2023 17:13:09 GMT

Hi @froi_borja_ama,

I have not tested with username, but for cert assignment with username, I assume changing this setting in JAMF to CN=$USERNAME should work.

Let me know if it works.

Re: Cloudpath Enrollment System SCEP integration with JAMF

froi_borja_ama — Mon, 27 Feb 2023 22:54:47 GMT

Hi Vijay,

I did some trial and error and this is what I'm getting the following below.

CN=$USERNAME -> $NAME
CN=$MACADDRESS -> actual mac add
CN=$SERIALNUMBER -> actual serial
CN=$HOSTNAME -> $HOSTNAME

Re: Cloudpath Enrollment System SCEP integration with JAMF

froi_borja_ama — Sun, 05 Mar 2023 02:31:37 GMT

Hi Vijay,

I have done a trial and error regarding the subject and here is what I have got so far:

Config Output

CN=$DEVICENAME -> "$DEVICENAME"
CN=$USERNAME -> SCEP certificate installation failing
CN=$EMAILADDRESS. -> "ADDRESS"
CN=$SERIALNUMBER. -> Actual serial number

Re: Cloudpath Enrollment System SCEP integration with JAMF

vijaykuniyal — Mon, 06 Mar 2023 16:23:31 GMT

Hi @froi_borja_ama,

The 2 environment variable for username are $USERNAME and ${ROLLUP_USERNAME}.

Test using ${ROLLUP_USERNAME}.

Re: Cloudpath Enrollment System SCEP integration with JAMF

vijaykuniyal — Thu, 27 Apr 2023 22:23:21 GMT

Hi @froi_borja_ama,

Did you try with $USER for OSX.

Detailed list of variables can be found here for JAMF.

https://docs.jamf.com/10.41.0/jamf-pro/documentation/Computer_Configuration_Profiles.html