How to configure JumpServer single sign-on (SSO) in IDaaS-Identity as a Service(IDaaS)-阿里云帮助中心

This topic describes how to configure single sign-on (SSO) for JumpServer in IDaaS.

Application overview

JumpServer is the world's first open-source bastion host. It uses the GNU GPL v2.0 open-source license and is an operations and maintenance (O&M) security audit system that complies with the 4A specification.

Note

JumpServer supports multiple protocols. IDaaS integrates with it using the SAML 2.0 protocol and provides an application template. JumpServer added support for SAML 2.0 in version 2.17.0, released on December 16, 2021. If your version does not support SAML 2.0, you can use the IDaaS OIDC protocol template to integrate with the OIDC authentication method supported by JumpServer.

Starting with JumpServer version 3, both SAML 2.0 and OIDC authentication are enterprise features. For more information, see the JumpServer SAML 2.0 integration documentation and the JumpServer OIDC integration documentation.

Procedure

Step 1. Create an IDaaS application

As an administrator, go to Applications > Marketplace and search for JumpServer. After you confirm the application name, click Add Application.

After you add the application, you are automatically redirected to the SSO configuration page.

Configure SSO

In the base URL field, enter the JumpServer access URL.

Keep the default settings for all other options and click Save to complete the SSO configuration.

Note

application account: By default, the IDaaS account name is the login identifier for the application. For flexible configuration, see Configure SAML Application Accounts. Authorization Scope: Select All Users. If you want to specify which IDaaS accounts can access the application, see Application Authorization.

Get JumpServer configuration information

In the Application Configuration section at the bottom of the page, copy the IdP metadata URL.

Step 2. Configure SSO in JumpServer

Configuring SSO in JumpServer is straightforward.

Generate a certificate

The SAML protocol relies on certificates. Because JumpServer cannot generate a certificate on its own, you must provide one. You can use an SSL tool to generate a public-private key pair or use this link to generate one.

To generate a certificate by using the link, fill in the form on the page. You can enter any information, but we recommend that you provide accurate details as they are included in the certificate. Click Generate Self-Signed Certs to generate the certificate.

Copy the content of the private key and save it locally as a .pem file. Save the X.509 public key certificate as a .cer file.

You will need to upload these two files during configuration.

Configure JumpServer

In a new browser tab, log in to the JumpServer console with an administrator account.

Go to System Settings > Authentication Settings to open the authentication method configuration page. Next to SAML 2 Authentication, click Enable.

You only need to configure the following parameters:

Parameter	Description
SP Key	Upload the `.pem` file that contains the private key you generated in the previous step.
SP Certificate	Upload the `.cer` file that contains the X.509 public key certificate you generated in the previous step.
Enable SAML 2 Authentication	Select the checkbox.
IdP metadata URL	Enter the metadata URL provided by IDaaS.
Advanced Settings parameter: `strict`	Set the value of `strict` to `false`. Note Setting `strict` to `false` poses a security risk. However, this configuration is a temporary workaround because the official JumpServer documentation for SAML configuration is unclear. We will monitor for updates from JumpServer and will update this guide as soon as a more secure method is available. If you have high security requirements, we recommend that you use the OIDC protocol to configure JumpServer.

After you complete the configuration, click Submit at the bottom of the page.

You can now log in to JumpServer by using an IDaaS account.

Step 3. Test SSO

You are now ready to test SSO for JumpServer.

JumpServer supports both IdP-initiated SSO from the IDaaS portal and SP-initiated SSO from the application.

Note

JumpServer supports just-in-time provisioning by default. During single sign-on, if the specified application account does not exist in JumpServer, it is created automatically. Manage access permissions for JumpServer in IDaaS.

IdP-initiated SSO

SP-initiated SSO

In an incognito browser window, open the JumpServer login page and click SAML 2 Authentication at the bottom.

After you authenticate with your IDaaS account, you are logged in to JumpServer.