11.32 Additions

What's new

GET /v3/sso/oidc-broker-config — new

Returns the OIDC broker identity provider configuration currently selected for the tenant, read live from the remote authentication service. Use it before an update to see the stored clientAuthMethod — that value determines which credential a PUT has to supply.

Secret fields (clientSecret, privateKeyJwt) are never returned.

Requires Read SSO Settings.

Response: OidcBrokerConfig. clientType, clientAuthMethod, and productUserMapping are always present but may be null; a value the authentication service introduces in a newer release reads as null rather than failing the response.

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "clientType": "CONFIDENTIAL",
  "clientAuthMethod": "CLIENT_SECRET",
  "productUserMapping": "EMAIL",
  "productUsernameClaim": "email",
  "capabilities": ["ADMIN_SSO"],
  "discoveryUrl": "https://example.okta.com/.well-known/openid-configuration",
  "clientId": "my-client-id",
  "scopes": ["openid", "profile"],
  "redirectUris": ["https://app.jamf.com/callback"],
  "enabled": true,
  "createdAt": "2024-01-15T10:30:00Z",
  "updatedAt": "2024-01-16T08:45:00Z"
}

PUT /v3/sso/oidc-broker-config — new

Replaces the contents of the tenant's selected broker configuration. The configuration to update is the tenant's stored broker selection, so there is no id in the path or body.

This is a full replacement, not a merge. Every non-secret field is overwritten with what you send, so send all of them on every update. Three points worth reading before you call it:

• enabled is required on every update. The authentication service replaces it each time, so omitting it would silently re-enable a disabled configuration.
• Secrets are kept when omitted. Leave out clientSecret and privateKeyJwt to retain what's stored; supply one to rotate it.
• Changing clientAuthMethod requires the new method's credential in the same request. The authentication service clears the credential belonging to the method you're leaving, so switching to CLIENT_SECRET without a clientSecret (or to PRIVATE_KEY_JWT without a privateKeyJwt) is rejected with a 400. The same applies when the method is already set but no credential is stored yet.

clientType is always written as CONFIDENTIAL, capabilities is always ADMIN_SSO, and redirectUris carries over from the stored configuration. None of the three can be set through this request.

Requires Update SSO Settings.

Request: OidcBrokerConfigUpdate — clientAuthMethod, clientId, discoveryUrl, enabled, productUserMapping, and scopes (at least one) are required.

{
  "clientAuthMethod": "CLIENT_SECRET",
  "clientId": "my-client-id",
  "clientSecret": "***",
  "discoveryUrl": "https://example.okta.com/.well-known/openid-configuration",
  "productUserMapping": "EMAIL",
  "productUsernameClaim": "email",
  "scopes": ["openid", "profile"],
  "enabled": true
}

DELETE /v1/notifications — new

Dismisses every dismissible notification for the current user and site in one call. Previously this meant reading GET /v1/notifications and issuing a DELETE /v1/notifications/{type}/{id} per notification.

Requires Dismiss Notifications — the same privilege as the existing per-notification delete, so API roles that can already dismiss notifications need no change.

Returns 204 with no response body.