JumpServer Single Sign-On

Overview

This article describes how to log in to JumpServer through BambooCloud IDaaS.

There are currently two methods: OIDC and CAS. You only need to choose one.

CAS Authentication

JumpServer official CAS documentation

BambooCloud IDaaS Configuration

1. Add the pre-integrated application JumpServer CAS.

   

2. Configure the callback address: http://{jumpserver-access-address}/core/auth/cas/login/?next=%2F

   Application logout address: JumpServer CAS logout address, fill in http://{jumpserver-service-address}//core/auth/cas/logout/

   

3. User authorization: Authorization Management > Application Account > Add Account.

JumpServer Configuration

1. Log in to the console as an administrator, go to System Settings, and select Authentication Settings > CAS Authentication.

   

2. Configure parameters and submit.

   

   Parameter	Description
   Enable CAS Authentication	Check to enable CAS authentication
   Server Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/ams/cas/
   Proxy Service Address	JumpServer access address
   Version	3
   Synchronous Logout	Check to log out BambooCloud IDaaS session synchronously when logging out of JumpServer
   Username Attribute	Default uid
   Enable Attribute Mapping	Check
   User Attribute Mapping	Default {"uid":"username"}
   Create User (If Not Exists)	Check

Login Verification

1. Access the JumpServer address and select CAS authentication.

   

2. You will be redirected to the BambooCloud IDaaS authentication interface. Authorized users authenticate and log in.

   

3. After successful authentication, enter JumpServer.

   

4. The administrator views the user.

   

OIDC Authentication

JumpServer official OpenID documentation

BambooCloud IDaaS Configuration

1. Add the pre-integrated application JumpServer OIDC.

   

2. Configure the callback address.

   

   Parameter	Description
   Redirect URI	Callback address, fill in http://{jumpserver-service-address}/core/auth/openid/callback
   LogoutURL	Fill in http://{jumpserver-service-address}/core/auth/openid/logout/
   Authorization Code Mode	Enable
   Implicit Authorization Mode	Disable
   *TOKEN Signature Algorithm	RS256
   *Access Token Validity Period	Default two hours
   *Refresh Token Validity Period	Default 0

3. User authorization: Authorization Management > Application Account > Add Account.

4. Enter the application details to obtain clientId and ClientSecret.

   

5. Go to Settings > Service Configuration > OIDC to view OIDC settings.

   

JumpServer Configuration

1. Log in to the console as an administrator, go to System Settings, and select Authentication Settings > OIDC Authentication.

   

2. Configure parameters and submit.

   

   Parameter	Description
   Enable OIDC Authentication	Check
   JumpServer Address	JumpServer access address
   Client ID	BambooCloud IDaaS application clientId
   Client Secret	BambooCloud IDaaS application clientSecret
   Use Keycloak	Do not check
   Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/
   Authorization Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/authorize
   Token Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/token
   JWKS Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/keys
   User Info Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/userinfo
   Logout Session Endpoint Address	https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/logout
   Signature Algorithm	RS256
   Signature Key	The key corresponding to the RS256 algorithm in https://{BambooCloud IDaaS tenant domain}.bccastle.com/api/v1/oauth2/keys
   Connection Scope	openid
   Token Validity Time	Default 60
   Claims	Checked by default
   Usage Status	Checked by default
   Temporary Use	Checked by default
   Always Update User Info	Checked by default
   Ignore SSL Certificate Verification	Checked by default
   Share Session	Checked by default

Login Verification

1. Access the JumpServer address and select OIDC authentication.

   

2. You will be redirected to the BambooCloud IDaaS authentication interface. Authorized users authenticate and log in.

   

3. After successful authentication, enter JumpServer.

   

4. The administrator views the user.

   

Appendix

If you enter JumpServer by clicking the JumpServer Logo in the BambooCloud IDaaS User Center, the following configuration is required.

CAS

In the BambooCloud IDaaS Enterprise Center, enter the application details Login Configuration > Website Application, modify the Mount URL, copy the CAS address of the JumpServer login page, and paste it here.

OIDC

In the BambooCloud IDaaS Enterprise Center, enter the application details Login Configuration > Website Application, modify the Mount URL, copy the OpenID address of the JumpServer login page, and paste it here.