Skip to content
Actagate

Set up SSO with JumpCloud

This page is for organization owners and admins who want members to sign in to Actagate with their JumpCloud account. You create an OIDC SSO app in JumpCloud, add a connection on the Actagate settings screen, test it, and then activate it.

Before you start, ask your operator to set SSO_SECRET_ENCRYPTION_KEY and WEB_BASE_URL (see Single sign-on basics).

1. Create the app in JumpCloud

Section titled “1. Create the app in JumpCloud”
  1. In the JumpCloud Admin Portal, open Access > SSO Applications > + Add New Application and choose Custom Application. Under Manage Single Sign-On, choose Configure SSO with OIDC
  2. Leave the grant type set to Authorization Code
  3. Enter the temporary value https://<host>/api/auth/sso/callback/0 in Redirect URIs. The real URL is known after you save the connection in step 2
  4. Set Client Authentication Type to Client Secret Basic or Client Secret POST
  5. Enter https://<host>/login in the required Login URL field
  6. Leave Subject Claim set to JumpCloud User ID. In the attribute mapping, add the standard Email and Profile scopes
  7. Assign the app to the groups of the admin who will run the test and the members who will sign in, then press Activate. JumpCloud shows the client ID and secret
  8. Copy the client ID and secret. The secret is shown only once

Official documentation: JumpCloud SSO with OIDC

2. Add the connection in Actagate

Section titled “2. Add the connection in Actagate”
  1. Open Settings > Security (/ws/settings/security). Under Single sign-on, in “Pick a provider to add a connection”, open “JumpCloud”. The connection form opens
  2. Enter “Display name”, “Issuer URL”, “Client ID” and “Client secret”, then press “Add connection”. The screen shows “Connection saved.” and a new connection marked “Draft · Not tested” appears under “Connections”
  3. Copy the “Callback URL to register in the IdP” shown on the connection. It looks like https://<host>/api/auth/sso/callback/<connection ID>
  4. Register that URL in Redirect URIs in JumpCloud and delete the temporary value. Match the displayed value exactly, including the connection ID
Connection form (Okta example)
The connection form (Okta example). The JumpCloud form has the same fields: the provider hint, "Official setup guide", "Display name", "Issuer URL", "Client ID" and "Client secret"

The issuer depends on your region: https://oauth.id.jumpcloud.com/ for US, https://oauth.id.eu.jumpcloud.com/ for EU and https://oauth.id.in.jumpcloud.com/ for IN. One trailing slash is removed when you save. If that slash is the only difference from discovery, the connection still works.

Do not change Subject Claim to the email address. Actagate identifies users by sub, so an email change would make the user look like a different person.

After you save, the client secret is never shown again. The screen only says “Secret: set”.

3. Test

Section titled “3. Test”
  1. Press “Test” on the connection. The JumpCloud sign-in page opens
  2. Sign in with your own JumpCloud account. You return to the settings screen, which shows “Test passed. You can activate the connection.” The connection is now marked “Test passed”

The test runs the full authorization code flow with PKCE and checks the ID token signature, issuer, audience, expiry, nonce and sub. Your admin session stays as it is. The test creates no user and links no login method. If it fails, the screen shows a reason code.

4. Activate

Section titled “4. Activate”
  1. Press “Activate” on the connection. The screen shows “Connection activated. It is now available on the login screen.” and the status changes to “Active”

You can press “Activate” only after a test passes. Changing the Issuer URL, client ID or client secret clears the test result and returns the connection to draft.

5. Check sign-in

Section titled “5. Check sign-in”
  1. An invited member who is not an admin opens the login screen. A button labeled “Continue with ” is shown
  2. The member presses the button and signs in with JumpCloud. The Actagate screen opens
  3. Check that a user who is not assigned to the app in JumpCloud cannot sign in

On the first sign-in, Actagate matches the email address that the IdP marks as verified (email_verified) against the invited member’s email address. Owners and admins sign in with an existing method first, then link the connection with “Add ” under Settings > Login methods.

6. Troubleshooting

Section titled “6. Troubleshooting”
  • issuer_mismatch: the issuer does not match your region. Enter the issuer for your region
  • provider_rejected: check the app assignment and the URL in Redirect URIs
  • token_exchange_failed: check the client ID, the secret and the Client Authentication Type

Other reason codes are listed in SSO troubleshooting.