- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Certify user account with administrator permissions<\/li>\n\n\n\n
- Download Certify’s metadata<\/a><\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong><\/p>\n\n\n\n
- \n
- Certify only supports IdP-initiated authentication<\/li>\n<\/ul>\n\n\n\n
Creating a new JumpCloud Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Navigate to USER AUTHENTICATION <\/strong>> SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Click Upload Metadata<\/strong> and browse to the Certify metadata file.<\/li>\n\n\n\n
- Add or change any desired attributes.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Certify<\/strong><\/strong><\/h3>\n\n\n\n
- \n
- Log in to your Certify organization as an administrator.<\/li>\n\n\n\n
- On your Certify<\/strong> homepage, navigate to Configuration<\/strong> > Configure Single Sign On<\/strong>.<\/li>\n\n\n\n
- Select Single Sign On<\/strong>.<\/li>\n\n\n\n
- Optionally, if using SSO through the Certify mobile app, enter the following information:\n
- \n
- Certify Mobile Login URL<\/strong> – required for SSO through the mobile app and is where the user is directed after entering your company\u2019s Certify Mobile Company Code<\/strong>. This URL must be public facing and accessible to your users outside of your company\u2019s intranet. The page should accept the user’s IdP credentials and initiate a SAML 2.0 request to https:\/\/expense.certify.com\/saml2.aspx<\/kbd><\/li>\n\n\n\n
- Certify Mobile Company Code<\/strong> – create a code between 3 and 14 alphanumeric characters that is easy for your users to remember, like an abbreviated company name or acronym<\/li>\n\n\n\n
- Email Login URL<\/strong> – replaces expense.certify.com\/login.aspx<\/kbd> at the bottom of email notifications and ensures that users accessing Certify through the email notifications are sent to JumpCloud to authenticate<\/li>\n\n\n\n
- Logout Redirect URL<\/strong> – dictates where a user is redirected when they click \u201cLogout\u201d in the Certify application<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- In the X.509 Certificate field<\/strong>, copy and paste the contents of the JumpCloud SSO certificate downloaded in the previous section.<\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n\n\n\n
- Refer to Configuring a Custom Welcome Email<\/a> for information on creating and maintaining a custom welcome email.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong><\/h3>\n\n\n\n
- \n
- Access the JumpCloud User Console<\/a><\/li>\n\n\n\n
- Select the application’s tile<\/li>\n\n\n\n
- The application will launch and login the user<\/li>\n<\/ul>\n\n\n\n
Removing the SSO Integration<\/strong><\/h2>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nThese are steps for removing the integration in JumpCloud. Consult your SP’s documentation for any additional steps needed to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users losing access to the application.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To deactivate<\/strong><\/strong> the SSO Integration<\/strong><\/h3>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Certify Mobile Company Code<\/strong> – create a code between 3 and 14 alphanumeric characters that is easy for your users to remember, like an abbreviated company name or acronym<\/li>\n\n\n\n
- Select Single Sign On<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Navigate to USER AUTHENTICATION <\/strong>> SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Certify only supports IdP-initiated authentication<\/li>\n<\/ul>\n\n\n\n