SSO using Custom SAML Application Connectors

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. If you don’t see a connector for an application that your organization uses, you can connect it to JumpCloud with the custom SAML 2.0 Connector. Also known as the Custom SAML App, this connector can be used with any application that supports SAML-based SSO. Be aware that you need in-depth knowledge of the Service Provider’s (SP) SAML compatibility and requirements to use the SAML 2.0 connector.

Read this article to learn how to configure the Custom SAML 2.0 Application Connector.

 Prerequisites

• A JumpCloud administrator account.
• JumpCloud SSO Package or higher or SSO add-on feature.
• An account with appropriate permissions to set up SAML in the SP.
• A public certificate and private key pair are required to successfully connect applications with JumpCloud. After you activate an application, we automatically generate a public certificate and private key pair for you. You can use this pair or upload your own.
  • Learn how to manage certificates and private keys. 
  • Learn how to generate a public certificate and private key pair. 
• Service providers can differ in their behavior, especially when it comes to existing user accounts. Make sure you understand all of the steps you need to take on the SP side for SSO and JIT provisioning. 

Configuring the Custom SAML 2.0 Connector

To gather information from the Service Provider (SP)

1. Find out if metadata is available from the SP. If metadata is available, download it so that you can use it to configure the connector in JumpCloud. 
2. Determine the attributes that are required for SAML/SSO. 
3. If the SP requires it, enable SAML functionality. 
4. Keep the SP information handy when you start configuring the SSO connector in JumpCloud.

To configure JumpCloud

1. Log in to the JumpCloud Admin Portal.
2. Go to User Authentication > SSO Applications.
3. Click + Add New Application:
   • Click Select on the Custom Application tile, OR
   • Search for Custom SAML App
4. Click Next.

5. Select Manage Single Sign-On (SSO), select either the Configure SSO with SAML or Configure SSO with OIDC radio button and click Next.
6. In the Display Label, type a name for the application. This is the name that will be shown to users in the User Portal.
7. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show this application in User Portal. Under Advanced Settings, you can specify a value for the SSO IdP URL. If no value is entered, it will default to https://sso.jumpcloud.com/saml2/<applicationname>.

8. Click Save Application and then Configure Application.
9. You can populate required connector fields for a custom SAML application by:
   • Clicking the Upload Metadata button - browse to and upload the SP metadata file.
   • Manually populating connector field data. See SSO Application Fields. 
10. Add any additional ACS URLs.
11. Click Replace SP Certificate, if necessary.
12. By default, the SAMLSubject’s NameID is email, but can be changed to any of the attributes in the dropdown list, including a custom attribute.
    • To use the custom attribute option, type the name of the custom attribute exactly as on the user record. A value must be entered for each user who is connected to this integration. Otherwise, they won't be able to log in to the application.

13. SAMLSubject NameID Format is the format that will be sent for the SAMLSubject's NameID. Select any of the values in the dropdown list.

14. The Signature Algorithm by default is RSA-SHA256. If necessary, it can be changed to RSA-SHA1.
15. By default, SAML Authentication Responses are signed. You may add additional security by choosing to sign SAML Authentication Assertions or both SAML Authentication Responses and Assertions.
16. Optionally, you can add a Default Relay State.
17. For SP-initiated only authentication, you must add a Login URL.
18. Optionally, select Declare Redirect Endpoint.
19. Add any additional User, Constant, or Group Attributes that are required for SAML/SSO. If you’d like, you can add more than what is required, but make sure the SP supports them. 
20. Click save to update the connector. After the application is activated, a public certificate and private key pair are generated for the application. 
21. Download the certificate if you need to upload it to the SP.
22. Open the application and click Export Metadata or Copy Metadata URL if the SP needs metadata to complete setup.

To configure the SP

1. Create the JumpCloud application in the SP.
2. Upload JumpCloud’s metadata file to the SP. This populates the SAML attributes in the SP. 
3. Follow the SP’s requirements for certificate uploads.
4. Save the SP configuration settings. 

Configuring JIT Provisioning 

Important Considerations

• Not all SPs support JIT provisioning. 
• Determine if JIT provisioning is inherently enabled in the SP or if you need to manually enable it. 
• Understand what attributes are required from the SP for JIT provisioning. You can find this information in the SP’s documentation or by reaching out to the SP’s customer success team. 

To use JIT provisioning with the SAML 2.0 Connector

1. Log in to the JumpCloud Admin Portal.
2. Create a new application or select your Custom SAML app from the Configured Applications list. 

3. Configure the required JIT attributes in JumpCloud. 
4. Click save. 

Group Attributes 

• Groups that connect the user to the application are included in assertions to that application. The Groups Attribute Name is the SP's name of the group attribute (e.g. memberOf). 
• If the Group Attribute option is selected and the field is pre-populated with the group attribute name, that means we’ve validated that the group attribute is supported by the SP. If the group attribute option isn’t selected and the Group Attribute Name field is empty, you will need to contact your SP if group attributes are supported.

• Group attributes may be used in some SPs to map roles.