Tutorial: How to Configure SAML with JumpCloud⁠

You need the following to get started:

• A JumpCloud account.

• A deployed Access Server.

With JumpCloud, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.

2. Select Authentication → SAML.

3. You'll need the following information:

   1. SP Identity.

   2. SP ACS.

Now that you have your SP information, you can create a new JumpCloud SAML app and enter that information during app creation:

1. Sign in to your JumpCloud admin portal.

2. Under User Authentication, click SSO.

3. Click + to add a new SSO app.

4. Click Custom SAML App.

5. Provide a Display Label and optional application information and click the SSO tab.

6. Use the SP information from Access Server to enter the following into the JumpCloud app:

   1. IdP Entity ID: Enter the JumpCloud URL, https://console.jumpcloud.com.

   2. SP Entity ID: Enter the Access Server SP Identity.

   3. ACS URL: Enter the Access Server SP ACS.

   4. SAMLSubject NameID: Select email.

   5. SAMLSubject NameID Format: Select urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified.

   6. Signature Algorithm: Select RSA-SHA256.

   7. Default RelayState: Enter 'cws' for the Client Web UI or 'profile' to provide users with a downloadable profile. (See "How to set up IdP-initiated flow" below for more details.)

   8. Check the box for Declare Redirect Endpoint.

   9. IdP URL should be https://sso.jumpcloud.com/saml2/saml2.

7. Click the User Groups tab and assign user groups to the SSO app.

8. Click activate.

The simplest way to set up JumpCloud SAML for Access Server is to provide the metadata XML file (option 1), but you can also manually configure it (option 2).

Once you’ve provided the SAML configuration for your IdP, you can enable it for users.

1. Sign in to the Admin Web UI.

2. Select Authentication → SAML.

3. Select the toggle to turn on Enable SAML authentication.

4. Select Save Settings and Update Running Server.

You can now enable SAML as the global default authentication or for specific groups and users.

You can configure an IdP-initiated flow for signing into Access Server from JumpCloud with the following steps:

1. Sign in to the JumpCloud admin portal.

2. Click SSO, and click your custom SAML app.

3. Click the SSO tab and scroll down to the Default RelayState field.

4. Enter one of the following for Default RelayState:

   1. cws: This directs your users to the Client Web UI after sign-in.

   2. profile: This directs your users to a profile download after sign-in.

5. Save changes.

Your users can now sign in to JumpCloud and find the Access Server SAML application under My Apps.

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

• Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script