User Authentication with JumpCloud¶
Our JumpCloud authentication authority lets you log users in at the agent with your existing JumpCloud tenant. Using JumpCloud with Enclave means you can:
- Use any MFA mechanism supported by JumpCloud for authentication.
- Apply JumpCloud Conditional Access Policies to user logins.
- Require JumpCloud-enrolled device membership as well as Enclave enrollment for machine identity.
Create the JumpCloud SSO Application¶
The first step is to login to your JumpCloud admin console, and select SSO Applications from the left-hand menu.
Then click Add New Application. You will be presented with a screen of "Featured Applications", but you should select Custom Application.
When asked to select the features to enable for the application, select Manage Single Sign-On, and choose Configure SSO with OIDC:
On the next screen, provide a display name for this application ('Enclave', for example), and optionally use this image file as a logo for the application.
Untick the Show in User Portal option, to avoid confusing users, since they cannot initiate login to the Enclave Agent from within the JumpCloud portal.
Continue to configure the application within JumpCloud, and set up the OpenID Connect Configuration. Set the following values in the SSO tab:
|Grant Type||Enable Refresh Token|
|Redirect URIs||Specify two URIs:
|Client Authentication Type||Select Public (None PKCE)|
|Login URL||Set to https://enclave.io; this value is never actually used, since the app isn't shown in the user portal|
|Attribute Mapping||Enable the Email and Profile standard scopes|
Once you press Activate, you will be given a Client ID. Copy this, because you will need it to create your Trust Requirement.
Creating your Trust Requirement¶
Now we have all the JumpCloud configuration set up, we can create our Enclave Trust Requirement.
When defining a new User Authentication Trust Requirement in the Enclave Portal, select JumpCloud from the Authority dropdown, and provide the Client ID you collected in the previous step.
Once you press Save you can start using your JumpCloud Trust Requirement in an Enclave Policy. Your users will then be prompted to login and will be sent to your JumpCloud tenant for authentication.