Integrate with Amazon IAM (Multiple Roles)

JumpCloud enables employees of your organization to sign into Amazon's Web Service with role-based access using multiple SSO Connectors. Each connector you create for Amazon IAM can allow for a specific and unique role to be set. Using Tags will enable you to assign specific users to each specific connector.

How does JumpCloud’s Single Sign-on Work?

JumpCloud leverages the standard SAML 2.0 protocol to securely perform authentication operations between our user directory (the 'identity provider' or IdP) and Amazon IAM (the 'service provider' or SP). Amazon IAM only supports IdP-Initiated SSO.

• IdP-Initiated: Employees will click the SP application button on their JumpCloud user console to gain access or use the associated IdP URL to sign in with their JumpCloud credentials.

How do employees access Single Sign-On?

Employees can visit the URL directly for the service providers supported by JumpCloud that have been configured and activated by the JumpCloud Administrator. The URL can be directly launched in a user's browser or triggered from hyperlinks on webpages or embedded links in emails. Employees can also launch the SaaS application from the JumpCloud's system user console (the 'employee console'). The system user console provides launch points for each SaaS application supported by JumpCloud and activated by an Administrator. 

Prerequisites

• In order to successfully complete the integration between JumpCloud and Amazon AWS (via IAM), you must have administrative rights to access configuration settings of the service provider. 

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
7. If this is a Bookmark application, enter its URL in the Bookmark URL field.
8. Click Save Application.
9. If successful, click:
   • Configure Application and go to the next section.
   • Close to configure your new connector at a later time.

Configuring the SSO Integration

To configure JumpCloud

1. Create a new application or select it from the Configured Applications list.
2. Select the SSO tab.
3. In the CONSTANT ATTRIBUTES section, leave the default settings for the values under Name <https://aws.amazon.com/SAML/Attributes/RoleSessionName>; and <https://aws.amazon.com/SAML/Attributes/Role>; respectively.
4. In the first value field, leave the default value of SSO-User.
5. In the second value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud
   (ReplaceYOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account).
6. In the field terminating the IdP URL, change the default value to aws-a
7. Click save. 

Click on the Applications link in the side navigation

1. Click on the Amazon Web Services Icon
2. For values under Name, leave the default setting (https://aws.amazon.com/SAML/Attributes/RoleSessionName) and https://aws.amazon.com/SAML/Attributes/Role respectively.
3. Click Upload IdP Private Key and upload your private key (see note above)
4. Click Upload IdP Certificate and upload your public certificate (see note above)
5. In the first Value field, leave the default value of SSO-User
6. In the second Value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud (ReplaceYOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account)
7. In the IdP URL field, change the default value to aws-a
8. Enter in a Display Label for this Connector
9. Click Activate
10. Click the export metadata button for the Amazon IAM entry (this will download a metadata file named JumpCloud-aws-metadata.xml)
11. Repeat Steps 1-7 for the Second AWS SSO Connector
12. In the second Value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud (Replace YOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account and ensure that this field has arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML2-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud2 )
13. In the IdP URL field, change the value to aws-b
14. Enter in a Display Label for this Connector
15. Click Activate
16. Click export metadata button for the Amazon IAM entry (this will download a metadata file named JumpCloud-aws-metadata-2.xml

​​To configure AWS

1. Log in to Amazon Web Services console for your organization
2. Under the Security & Identity section, click on Identity & Access Management (IAM)
3. Click Identity Providers in the Sidebar under Details
4. Click Create Provider
   • ​Provider Type: SAML
   • Provider Name: JumpCloud
   • Click the Choose File button next to Metadata file and upload the JumpCloud-aws-metadata.xml file (downloaded in step 12 above)
   • Click Next Step then select Create
5. Create a second Identity Provider
   • Provider Type: SAML
   • Provider Name: JumpCloud2
   • Click the Choose File button next to Metadata file and upload the JumpCloud-aws-metadata-2.xml file (downloaded in step 18 above)
   • Click Next Step then select Create​
6. ​Click Roles in the Sidebar under Details
7. Click Create New Role ​​
   • Role Name: SAML-User
   • Role Type: Role for Identity Provider Access
     • ​Grant Web Single Sign-On (WebSSO) access to SAML providers ​
   • ​SAML Provider: JumpCloud
   • Click Next Step then Next Step again on the Verify Role Trust page
   • Select the desired Policies from the list of available policies then click Next Step
   • Review the information, then select Create Role
8. ​Click Create New Role for the second time
   • Role Name: SAML2-User
   • Role Type: Role for Identity Provider Access
     • ​Grant Web Single Sign-On (WebSSO) access to SAML providers
   • ​SAML Provider: JumpCloud2
   • Click Next Step then Next Step again on the Verify Role Trust page
   • Select the desired Policies from the list of available policies then click Next Step
   • Review the information, then select Create Role

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: Groups.
4. Select the check box next to the group of users you want to give access.
5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Testing Your Single Sign-on (SSO) Configuration

IdP-Initiated Flow

• In the JumpCloud Admin Console, create a tag called SSO-AWS-A  and then select the users you wish to grant access to the resources provided in Step 7 of Part 2
• Create a second tag called SSO-AWS-B and then select the users you wish to grant access to the resources provided in Step 8 of Part 2