- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- You must have GitLab SaaS. This is functionality is not available with GitLab self-managed<\/li>\n\n\n\n
- You need to have a\u00a0GitLab Silver account<\/a> or higher<\/li>\n\n\n\n
- Access to modify the GitLab server per\u00a0this article<\/a><\/li>\n\n\n\n
- Your GitLab domain and Server URL<\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- Group SSO<\/a>\u00a0must be enabled for the group. For more information, see\u00a0SCIM setup documentation<\/a><\/li>\n\n\n\n
- SAML SSO is not supported at the subgroup level<\/li>\n\n\n\n
- If you delete an integrated GitLab application from your Applications list, the application is removed from JumpCloud, but any previously bound users remain active in GitLab. These users will be able log in to GitLab with the password they used prior to enablement of SSO to the GitLab application from your JumpCloud account<\/li>\n\n\n\n
- If you deactivate the Identity Management on your GitLab application, previously bound users remain active in GitLab and able to authenticate using SSO. No further updates will be made to user accounts via the Identity Management integration<\/li>\n\n\n\n
- If you need to update your token, you must\u00a0deactivate the IdM integration<\/a>, update the token, and then reactivate the IdM integration<\/li>\n\n\n\n
- Account takeovers are not supported. For more information on this take a look\u00a0here<\/a><\/li>\n\n\n\n
- If a user is unable to sign in look\u00a0here<\/a><\/li>\n\n\n\n
- New users provisioned from JumpCloud will receive an email invitation from GitLab<\/li>\n\n\n\n
- When SCIM is enabled for a GitLab group, membership of that group is synchronized between GitLab and JumpCloud. Groups must be created manually in GitLab and then have SCIM support enabled for it to be managed via SCIM<\/li>\n\n\n\n
- When de-provisioning users, the users are removed from the GitLab group. De-provisioning does not delete the user account<\/li>\n\n\n\n
- Currently, you can\u2019t update users in GitLab with our Identity Management Connector<\/li>\n\n\n\n
- If a user\u2019s password expires in JumpCloud, their account becomes suspended and they are deactivated in all applications that have Identity Management configured and, are associated to them. Once the user\u2019s password is updated, the account and previously associated applications are reactivated<\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
- \n
- A default set of attributes are managed for users. See the\u00a0Attribute Mappings<\/a>\u00a0section for more details<\/li>\n\n\n\n
- The\u00a0username\u00a0<\/kbd>and\u00a0email\u00a0<\/kbd>should match<\/li>\n\n\n\n
- GitLab generates the username <\/kbd>attribute from the JumpCloud user email<\/li>\n<\/ul>\n\n\n\n
Creating a new JumpCloud Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- Replace any instances of YOURDOMAIN.com and YOUR_GITLAB_SERVER_URL with your GitLab values.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure GitLab<\/strong><\/h3>\n\n\n\n
- \n
- Log in to Gitlab. <\/li>\n\n\n\n
- On the left sidebar, select Search or go to<\/strong> and find your group.<\/li>\n\n\n\n
- Select Settings > SAML SSO<\/strong>.<\/li>\n\n\n\n
- Enter the following information:\n
- \n
- Identity provider single sign-on URL<\/strong> – copy and paste the JumpCloud IDP URL<\/strong>.<\/li>\n\n\n\n
- Certificate fingerprint<\/strong> field – enter the SHA-1 fingerprint for the certificate downloaded in the previous section.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nSee\u00a0Generate Custom Certificate and Private Key Pairs<\/a>\u00a0for instructions on determining your certificate fingerprint.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- In the Default membership role<\/strong> field, select the role to assign to new users. The default role is Guest<\/strong>. That role becomes the starting role of all users added to the group:\n
- \n
- In GitLab 13.3<\/a> and later, group Owners can set a default membership role other than Guest<\/strong>.<\/li>\n\n\n\n
- In GitLab 16.7 and later, group Owners can set a custom role<\/a> as the default membership role.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Select Enable SAML authentication for this group<\/strong>.<\/li>\n\n\n\n
- Optionally, you can select:\n
- \n
- Enforce SSO-only authentication for web activity for this group<\/strong>.<\/li>\n\n\n\n
- Enforce SSO-only authentication for Git activity for this group<\/strong>. For more information, see the SSO enforcement documentation<\/a>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Save changes<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Access the JumpCloud User Console<\/a><\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- JumpCloud asserts the user’s identity to the SP and is authenticated without the user having to log in to the application<\/li>\n<\/ul>\n\n\n\n
SP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Go\u00a0to the SP application login – generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
This varies by SP.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Login redirects the user to JumpCloud where the user enters their JumpCloud credentials<\/li>\n\n\n\n
- After the user is logged in successfully, they are redirected\u00a0back to the SP and automatically logged in<\/li>\n<\/ul>\n\n\n\n
Configuring the Identity Management Integration<\/strong><\/h2>\n\n\n\n
To configure GitLab<\/strong><\/h3>\n\n\n\n
- \n
- On the top bar, select Main menu > Groups<\/strong> and find your group.<\/li>\n\n\n\n
- On the left sidebar, select Settings > SAML SSO<\/strong>.<\/li>\n\n\n\n
- Select Generate a SCIM token<\/strong>.<\/li>\n\n\n\n
- Copy the:\n
- \n
- Token from the Your SCIM token<\/strong> field.<\/li>\n\n\n\n
- URL from the SCIM API endpoint URL<\/strong> field.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the Identity Management <\/strong>tab.<\/li>\n\n\n\n
- Click Configure<\/strong>.<\/li>\n\n\n\n
- You are presented with two fields:\n
- \n
- Base URL<\/strong> – enter the SCIM API endpoint URL<\/strong> copied in the previous section.<\/li>\n\n\n\n
- Token Key<\/strong> – enter the SCIM token<\/strong> generated in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Activate <\/strong>and if successful, click save<\/strong>.<\/li>\n\n\n\n
- You will receive a confirmation that the Identity Management integration has been successfully verified.<\/li>\n<\/ol>\n\n\n\n
Attribute Mappings<\/strong><\/h2>\n\n\n\n
The following table lists attributes that JumpCloud sends to the application. See Attribute Considerations<\/a> for more information regarding attribute mapping considerations. <\/p>\n\n\n\n
- Token Key<\/strong> – enter the SCIM token<\/strong> generated in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Select the Identity Management <\/strong>tab.<\/li>\n\n\n\n
- URL from the SCIM API endpoint URL<\/strong> field.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- On the left sidebar, select Settings > SAML SSO<\/strong>.<\/li>\n\n\n\n
- On the top bar, select Main menu > Groups<\/strong> and find your group.<\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Enforce SSO-only authentication for Git activity for this group<\/strong>. For more information, see the SSO enforcement documentation<\/a>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- In GitLab 16.7 and later, group Owners can set a custom role<\/a> as the default membership role.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- In GitLab 13.3<\/a> and later, group Owners can set a default membership role other than Guest<\/strong>.<\/li>\n\n\n\n
- Certificate fingerprint<\/strong> field – enter the SHA-1 fingerprint for the certificate downloaded in the previous section.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- Select Settings > SAML SSO<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- The\u00a0username\u00a0<\/kbd>and\u00a0email\u00a0<\/kbd>should match<\/li>\n\n\n\n
- Access to modify the GitLab server per\u00a0this article<\/a><\/li>\n\n\n\n