How to configure JumpServer single sign-on in IDaaS-Identity as a Service(IDaaS)-阿里云帮助中心

Configure single sign-on (SSO) for JumpServer in IDaaS.

Application overview

JumpServer is the world's first open-source bastion host. It uses the GNU GPL v2.0 open-source license and is an operations and maintenance (O&M) security audit system that complies with the 4A specification.

Note

JumpServer supports multiple protocols. IDaaS integrates with JumpServer based on the SAML 2.0 protocol and provides an application template. On December 16, 2021, JumpServer released v2.17.0, which added support for the SAML 2.0 protocol. If your version does not support SAML 2.0, you can use the IDaaS OIDC protocol template to integrate with the OIDC authentication method that JumpServer supports.

Starting with JumpServer V3, both SAML 2.0 and OIDC authentication are Enterprise Edition features. For more information, see JumpServer SAML 2.0 integration documentation and JumpServer OIDC integration documentation.

Procedure

Step 1: Create an IDaaS application

As an administrator, go to Applications > Marketplace, and search for JumpServer. After you confirm the application name, click Add Application.

After you add the application, you are automatically redirected to the SSO configuration page.

Configure SSO

In the root domain field, enter the JumpServer access URL.

Keep the default settings for all other options and click Save to complete the SSO configuration.

Note

Application account: By default, the IDaaS account name is used as the application logon identifier. To use a custom configuration, see Configure SAML accounts. Authorization scope: Change the value to All Users. To specify the IDaaS accounts that can access the application, see Identity as a Service:Authorization.

Get the JumpServer configuration information

In Application Configuration at the bottom of the configuration page, copy the IdP metadata URL.

Step 2: Configure SSO in JumpServer

Configuring SSO for JumpServer is simple.

Generate a certificate

The SAML protocol relies on certificates. Because JumpServer cannot generate a certificate itself, you must generate one separately. You can use an SSL tool to generate a public and private key pair (search for a solution that suits you), or use this link to generate one.

To generate a certificate by using the link, fill in the form on the page. You can enter any information, but provide accurate details where possible because they are included in the certificate. Click Generate Self-Signed Certs to generate the certificate.

Copy the content of the private key (Private Key) to your local machine and save it as a .pem file. Save the X.509 cert public key as a .cer file.

You need to upload these two files in the subsequent configuration.

Configure JumpServer

In a new browser tab, log on to the JumpServer console with an administrator account.

Go to System Settings > Authentication Settings to open the authentication method configuration page. Next to SAML 2 Authentication, click Enable.

The configuration form has many parameters, but most of them do not require your attention. You need to configure only the following parameters:

Parameter	Description
SP Key	The private key (Private Key) generated in the previous step. Upload the `.pem` file.
SP Certificate	The X.509 cert public key certificate generated in the previous step. Upload the `.cer` file.
Enable SAML2 Authentication	Select the checkbox.
IdP metadata URL	Enter the metadata URL provided in IDaaS.
Advanced Settings `strict`	Set the value of `strict` to `false`. Note Setting `strict` to `false` poses a security risk. However, because the official JumpServer website does not clearly describe the SAML configuration, this setting can be used only as a temporary workaround. We will closely follow the official JumpServer documentation and provide a complete and secure SAML service wherever possible. If you have high security requirements, use the OIDC protocol to configure JumpServer.

After you complete the JumpServer configuration, click Submit at the bottom of the page.

You can now try to log on to JumpServer with an IDaaS account.

Step 3: Test SSO

You can now test JumpServer SSO.

JumpServer supports both IdP-initiated SSO (from the IDaaS portal) and SP-initiated SSO (from the application).

Note

By default, JumpServer supports automatic account creation (Just-in-time Provisioning). During single sign-on, if the specified application account does not exist in JumpServer, the account is created directly and access is not denied. Manage JumpServer access permissions in IDaaS.

IdP-initiated SSO

Log on to the IDaaS portal with an IDaaS account that is authorized to use JumpServer, and click JumpServer on the page to initiate SSO.

SP-initiated SSO

In an incognito browser window, open the JumpServer logon page and click SAML2 authentication at the bottom of the page.

After your IDaaS account is verified, you are logged on to JumpServer directly.