SSO: JumpCloud

This article describes how to configure JumpCloud as your workplace's single sign-on identity provider (IdP). This process involves making modifications to your JumpCloud environment and your digital workplace. Once complete, users of your digital workplace will be able to sign in to it using their JumpCloud credentials.

To follow this process, you must be able to add applications to your JumpCloud environment and be a workplace administrator in your digital workplace.

Sections in this article:

Configuring a JumpCloud single sign-on application

Follow these steps to configure a SAML app in your JumpCloud environment:

  1. Log into your JumpCloud Administrator Console.
  2. Select Applications from the navigation menu.
  3. Select + to add a new application.
  4. In the Configure Application window, search for Igloo and then select the Configure button next to it.
  5. Igloo does not currently provide XML metadata, so you must fill in the following fields manually:
    • Display Label: Enter a descriptive name for this application.
    • IDP Entity ID:  Leave the default value.
    • SP ENTITY ID: Modify and enter the following URL: 
      • https://[digital workplace URL].com/saml.digest
    • ACS URL: Modify and enter the following URL: 
      • https://[digital workplace URL].com/saml.digest
    • IDP URL: Leave the default value. However, if you have already set up an application using this URL, you will need to enter a new value of your choice.
  6. Select Activate to continue setting up the application. It should now appear in the list of Applications.
  7. Select this application's entry from the list of applications to view its details.
  8. While viewing the application, select IDP Certificate Valid and then select Download certificate to save a copy of the certificate to your device. 

Configuring your digital workplace's single sign-on

  1. Go to your digital workplace and sign in.
  2. Select  Control Panel.
  3. Under Membership, select Sign In Settings.
  4. Select Configure SAML Authentication.
  5. Configure the settings as described in the Configuration settings table below.
  6. Select Save.
Setting Description
Connection Name Enter a name for this connection. If you configure Sign in Settings to Use SAML button on Sign in screen, this name will be displayed on the button.
IdP Login URL

Copy and paste the IDP URL from the JumpCloud configuration instructions into this field.
IdP Logout URL Leave this field empty. 
Logout Response and Request HTTP Type Select POST.
Logout Final Redirect URL Enter the URL of the location you want to send users to when they log out. If left blank, users will be redirected to your digital workplace's homepage. 
Binding Type

Select POST.
Public Certificate

Copy and paste the Certificate from the JumpCloud configuration instructions into this field. You will need to open the certificate file using a text editor.
Identity Provider

Select Other.
Identifier Type

Select Email Address.
Identifier Path

Enter /samlp:Response/saml:Assertion/saml:Subject/saml:NameID.
Session Index Path

Enter /samlp:Response/saml:Assertion/saml:AuthnStatement.
Email Path

Enter /samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="Email"]/saml:AttributeValue.
First Name Path

Enter /samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="FName"]/saml:AttributeValue.
Last Name Path

Enter /samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="LName"]/saml:AttributeValue.
Drift Time

Enter 5.
User creation on Sign in

Select how your digital workplace handles users who attempt to sign in when they have valid IdP credentials but are not members of the digital workplace.

Options include:

  • Create a new user in your site when they sign in (Users will be added to manage members on sign in)
  • Do not create new users when they sign in (Users not in manage members will be denied access)

When creating new users in your digital workplace this way, they will be created with the following details:

  • First Name (from First Name Path)
  • Last Name (from Last Name Path)
  • Email Address (from Email Path) 
  • CustomIdentifier (from Identifier Path if the Identifier Type is Custom Identifier) 
  • Membership to the All Members group.

If enabled, this option does not provide any additional user syncing functionality (e.g., additional fields, group membership, deprovisioning, etc.).

If your digital workplace uses the ILST to manage members, select Do not create new users when they sign in to avoid the creation of duplicate user accounts.
Sign in Settings

Select how users sign in to your workplace.

Options include:

  • Use SAML button on "Sign in" screen
  • Redirect all users to IdP

For setting up and testing the connection, it can be convenient to temporarily select Use SAML button on "Sign in" screen and then only switch to Redirect all users to IdP once you have confirmed that single sign-in is working correctly.
Configuration settings