Tutorial: How to Configure SAML with JumpCloud
This is a step-by-step guide for configuring SAML on Access Server with Okta.
Overview
Access Server 2.11 and newer supports authentication using SAML with JumpCloud as the identity provider. You can configure this in JumpCloud with Access Server as your service provider.
The following steps walk you through enabling SAML authentication for users and groups from JumpCloud to Access Server.
You need the following to get started:
A deployed Access Server.
Important
We recommend using all lowercase usernames when signing in with SAML.
With JumpCloud, you must create a custom SAML application.
Now that you have your SP information, you can create a new JumpCloud SAML app and enter that information during app creation:
Sign in to your JumpCloud admin portal.
Under User Authentication, click SSO.
Click + to add a new SSO app.
Click Custom SAML App.
Provide a Display Label and optional application information and click the SSO tab.
Use the SP information from Access Server to enter the following into the JumpCloud app:
IdP Entity ID: Enter the JumpCloud URL, https://console.jumpcloud.com.
SP Entity ID: Enter the Access Server SP Identity.
ACS URL: Enter the Access Server SP ACS.
SAMLSubject NameID: Select email.
SAMLSubject NameID Format: Select urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified.
Signature Algorithm: Select RSA-SHA256.
Default RelayState: Enter 'cws' for the Client Web UI or 'profile' to provide users with a downloadable profile. (See "How to set up IdP-initiated flow" below for more details.)
Check the box for Declare Redirect Endpoint.
IdP URL should be https://sso.jumpcloud.com/saml2/saml2.
Click the User Groups tab and assign user groups to the SSO app.
Click activate.
Option 1: Download the JumpCloud metadata file for automatic configuration
With your new app, click the SSO tab.
Under JumpCloud Metadata, click Export Metadata.
Option 2: Copy the JumpCloud SAML data for manual configuration
With your new app, click the SSO tab.
Copy the contents in IdP Entity ID, IDP URL, and click IDP Certificate Valid to download the certificate in PEM format.
The simplest way to set up JumpCloud SAML for Access Server is to provide the metadata XML file (option 1), but you can also manually configure it (option 2).
Option 1: Upload the JumpCloud metadata file in the Admin Web UI
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
Click Choose File for Select IdP Metadata File.
Select your JumpCloud metadata XML file, click Upload, and click Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
Option 2: Manually configure JumpCloud SAML
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Manually to expand the section.
Paste the following from JumpCloud to the Access Server fields:
Paste the JumpCloud IDP URL into Access Server’s Sign On Endpoint.
Paste the JumpCloud IdP Entity ID into Access Server’s IdP EntityId.
Paste the JumpCloud certificate.pem into Access Server’s Certificate (PEM format).
The IdP fields save.
You can configure an IdP-initiated flow for signing into Access Server from JumpCloud with the following steps:
Sign in to the JumpCloud admin portal.
Click SSO, and click your custom SAML app.
Click the SSO tab and scroll down to the Default RelayState field.
Enter one of the following for Default RelayState:
cws: This directs your users to the Client Web UI after sign-in.
profile: This directs your users to a profile download after sign-in.
Save changes.
Your users can now sign in to JumpCloud and find the Access Server SAML application under My Apps.