Jamf OAuth Credentials

Description

General

• Documentation: https://developer.jamf.com/jamf-pro/docs/client-credentials
• Summary: Jamf is an Apple device management company. Jamf Pro API clients use the OAuth 2.0 client credentials flow: a client_id and a client_secret are exchanged for a short-lived access token to call the Jamf Pro API, with the privileges granted by the API roles assigned to the client. This detector catches the credentials together with the jamfcloud.com host of the Jamf Pro instance, so that the credentials can be checked.

Revoke the secret

A client secret can be rotated from the Jamf Pro web interface, under Settings > System Settings > API Roles and Clients > API Clients. Select the API client, click Rotate Client Secret, then Rotate Secret: the previous secret is invalidated and can no longer be used to generate access tokens. See Rotating a Client Secret. An API client that is no longer needed can be disabled with Disable API Client. See Disabling an API Client. Disabling or deleting an API client does not revoke access tokens that were already generated: they remain valid until they expire. Update any dependent apps and services with the new secret.

Details for Jamf OAuth Credentials

• Family: credentials

• Category: other

• Company: Jamf

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 0.02

• Prefixed: False