VaultOne: Integrate with JumpCloud SSO

Configure JumpCloud as your OpenID Connect (OIDC) Identity Provider to enable seamless and secure authentication for VaultOne users.

Creating a new JumpCloud Custom Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. In the the Custom Application tile, click Select.
5. Verify your selection by clicking Next.
6. Select the Manage Single Sign-On (SSO) and then SSO with OIDC.
7. Click Next.
8. In the Display Label, type VaultOne. Optionally, you can enter:
   • Description - add a description that users will see in their user portal
   • User Portal Image - choose Logo or Color Indicator
   • Show this application in User Portal - enable to show this application in your organization's user portal
9. Click Next and then Configure Application.

Configuring the SSO Integration

To configure JumpCloud

1. In the SSO tab, enter the following information:
   • Redirect URI - enter the full VaultOne login URL (ex. https://<YOUR-VAULT-NAME>.vault.jumpcloud.com/account/login)
   • Client Authentication Type - select Client Secret Post
   • Login URL - enter the same login URL you used for Redirect URI.
   • Attribute Mapping - select both Email and Profile
     • Under USER ATTRIBUTE MAPPINGS, click Add Attribute to add the attributes shown in the image below
     • Under CONSTANT ATTRIBUTES, click Add Attribute to add the attributes shown in the image below

2. Click Activate.
3. Copy the Client ID and Client Secret for the next section.

To configure VaultOne

1. In VaultOne, go to Administration > Settings > Identity Providers.
2. In the OpenID Connect Information section, select Enabled and then click + Add.
3. Enter the following information:
   • Grant Type - select Authorization Code Flow
   • Name - enter JumpCloud (or any clear identifier)
   • ClientID - paste the JumpCloud Client ID
   • Client Secret - paste the JumpCloud Client Secret
   • Issuer - enter https://oauth.id.jumpcloud.com/
   • Authorization Endpoint - enter https://oauth.id.jumpcloud.com/oauth2/auth
   • Authentication Type - select Client Secret Post
4. Click Save all.

Signing In to VaultOne with JumpCloud

1. Users who have been granted access to VaultOne can now sign in via SSO using their JumpCloud account.
2. In the JumpCloud User Portal, the application you configured (for example, “PAM VaultOne”) will appear. Click to sign-in.
3. You will be redirected to the VaultOne login page. Click “Sign in with OpenID” to complete authentication.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page. 

To authorize user access from the Application’s page

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save. 

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Removing the SSO Integration

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.