OneLogin - OIDC Password Updates Failure with JAMF/Kandji Due to MFA Enforcement in ROPG Authentication (4383467)

In environments integrating Mac device management platforms (e.g., JAMF Connect or Kandji) with OIDC authentication, password synchronization or login attempts may fail silently.

Administrators may observe:

• Repeated “OIDC password could not be provided” or similar failure events
• No visible error presented to end users during authentication attempts
• High volume of unresolved authentication failure events in logs

The issue typically appears during local password sync or device-level authentication workflows rather than browser-based login.

The issue is caused by incompatibility between:

• ROPG (Resource Owner Password Grant) authentication flows, and
• Multi-Factor Authentication (MFA) enforcement

ROPG-based authentication does not support interactive MFA challenges. When MFA is required:

• The authentication flow cannot be completed successfully
• The system does not prompt users for MFA input
• Authentication fails without clear feedback

For device management platforms:

• JAMF uses ROPG for local password sync operations
• Kandji local device apps behave similarly and cannot process MFA challenges

As a result, any MFA requirement enforced at the policy level blocks these flows.

To resolve the issue, implement a configuration that separates MFA requirements between authentication flows using App Security Policies.

For JAMF Connect

1. Create a secondary OIDC application connector:

   • Use the same configuration as the primary OIDC app
   • Assign a different OIDC client ID for ROPG-related operations

2. Apply an App Security Policy to this secondary app:

   • Disable (skip) MFA specifically for this application
   • Ensure standard MFA remains enforced for interactive login flows

3. Configure JAMF to use:

   • Primary OIDC app → for user login (MFA enforced)
   • Secondary OIDC app → for password sync (MFA bypassed)

This approach ensures:

• MFA remains enforced for user authentication
• ROPG flows complete successfully without MFA blocking them

For Kandji

1. Configure two separate OIDC applications:

   • One for web login authentication
   • One for local device password sync

2. Apply an App Security Policy to the local/device app:

   • Disable MFA enforcement for this specific application
   • Ensure MFA remains active for the web login app

3. Confirm feature requirement:

   • Enable the “low sensitivity” option in App Security Policy (feature flag required)

4. Ensure:

   • MFA is not required in the policy applied to the local app
   • Standard MFA policies remain active elsewhere

This prevents:

• OIDC password failures
• Excessive event log noise caused by repeated failures