This topic describes how to configure single sign-on (SSO) for JumpServer in IDaaS.
Application overview
JumpServer is the world's first open-source bastion host. It uses the GNU GPL v2.0 open-source license and is an operations and maintenance (O&M) security audit system that complies with the 4A specification.
JumpServer supports multiple protocols. IDaaS integrates with it using the SAML 2.0 protocol and provides an application template. JumpServer added support for SAML 2.0 in version 2.17.0, released on December 16, 2021. If your version does not support SAML 2.0, you can use the IDaaS OIDC protocol template to integrate with the OIDC authentication method supported by JumpServer.
Starting with JumpServer version 3, both SAML 2.0 and OIDC authentication are enterprise features. For more information, see the JumpServer SAML 2.0 integration documentation and the JumpServer OIDC integration documentation.
Procedure
Step 1. Create an IDaaS application
As an administrator, go to and search for JumpServer. After you confirm the application name, click Add Application.
After you add the application, you are automatically redirected to the SSO configuration page.
Configure SSO
In the base URL field, enter the JumpServer access URL.
Keep the default settings for all other options and click Save to complete the SSO configuration.
application account: By default, the IDaaS account name is the login identifier for the application. For flexible configuration, see Configure SAML Application Accounts. Authorization Scope: Select All Users. If you want to specify which IDaaS accounts can access the application, see Application Authorization.
Get JumpServer configuration information
In the Application Configuration section at the bottom of the page, copy the IdP metadata URL.
Step 2. Configure SSO in JumpServer
Configuring SSO in JumpServer is straightforward.
Generate a certificate
The SAML protocol relies on certificates. Because JumpServer cannot generate a certificate on its own, you must provide one. You can use an SSL tool to generate a public-private key pair or use this link to generate one.
To generate a certificate by using the link, fill in the form on the page. You can enter any information, but we recommend that you provide accurate details as they are included in the certificate. Click Generate Self-Signed Certs to generate the certificate.
Copy the content of the private key and save it locally as a .pem file. Save the X.509 public key certificate as a .cer file.
You will need to upload these two files during configuration.
Configure JumpServer
In a new browser tab, log in to the JumpServer console with an administrator account.
Go to to open the authentication method configuration page. Next to SAML 2 Authentication, click Enable.
You only need to configure the following parameters:
|
Parameter |
Description |
|
SP Key |
Upload the |
|
SP Certificate |
Upload the |
|
Enable SAML 2 Authentication |
Select the checkbox. |
|
IdP metadata URL |
Enter the metadata URL provided by IDaaS. |
|
Advanced Settings parameter: |
Set the value of Note
Setting |
After you complete the configuration, click Submit at the bottom of the page.
You can now log in to JumpServer by using an IDaaS account.
Step 3. Test SSO
You are now ready to test SSO for JumpServer.
JumpServer supports both IdP-initiated SSO from the IDaaS portal and SP-initiated SSO from the application.
JumpServer supports just-in-time provisioning by default. During single sign-on, if the specified application account does not exist in JumpServer, it is created automatically. Manage access permissions for JumpServer in IDaaS.
IdP-initiated SSO
Log in to the IDaaS portal with an authorized IDaaS account and click the JumpServer application icon to start SSO.
SP-initiated SSO
In an incognito browser window, open the JumpServer login page and click SAML 2 Authentication at the bottom.
After you authenticate with your IDaaS account, you are logged in to JumpServer.