This article provides a straightforward guide on setting up Single Sign-On (SSO) for VaultOne. We will walk through the process of configuring JumpCloud as your OpenID Connect (OIDC) Identity Provider to enable seamless and secure authentication for VaultOne users.
Step 1 — Creating a Custom Application in the JumpCloud Admin Portal
In the JumpCloud Admin Portal, go to SSO Applications in the left sidebar and click + Add New Application. In the dialog that appears, select Custom Application and click Next.
Choose Manage Single Sign-On (SSO), then select SSO with OIDC.
Follow the wizard to customize your application (for example, name and logo). After configuring the visual details, proceed to the summary screen and click Configure Application to open the configuration page where you will complete the setup.
Step 2 — Configuring SSO
On the SSO configuration page in the JumpCloud Admin Portal, complete the fields as follows.
Redirect URL: enter the full VaultOne login URL, for example:
Tip:
https://<YOUR-VAULT-NAME>.vault.jumpcloud.com/account/login
(replace <YOUR-VAULT-NAME> with your environment name).
Client Authentication Type: select Client Secret Post.
Login URL: enter the same login URL you used for Redirect URL.
Attribute Mapping: select both Email and Profile.
Click Activate to apply and enable the configuration.
Important:
Remember that you need to share this SSO Application with the User Groups that will be able to see this application on their User Portal
Step 3 — Configuring VaultOne to Accept SSO with JumpCloud
After clicking Activate in JumpCloud, copy the Client ID and Client Secret. You will use both in VaultOne.
In VaultOne, go to Administration > Settings, then click Identity Providers.
Under OpenID Connect Information, click Enable and then +Add.
Fill out the fields as follows:
Grant Type: Authorization Code Flow
Name: JumpCloud (or any clear identifier)
Client ID: paste the Client ID from JumpCloud
Client Secret: paste the Client Secret from JumpCloud
Issuer: https://oauth.id.jumpcloud.com/
Authorization Endpoint: https://oauth.id.jumpcloud.com/oauth2/auth
Selecione a opção Client Secret Post.
Click Save All in the top-right corner.
Step 4 — Signing In to VaultOne with JumpCloud
Users who have been granted access to VaultOne can now sign in via SSO using their JumpCloud account.
In the JumpCloud User Portal, the application you configured (for example, “PAM VaultOne”) will appear. Click it to start the sign-in.
You will be redirected to the VaultOne login page. Click “Sign in with OpenID” to complete authentication.
Important:
On first SSO, the user is automatically created in VaultOne and assigned to the platform’s default role. You can find this under Administration > Roles; the default role defines the user’s permissions.
If this is the user’s first access and you did not enable the “Activate user by default” option in Administration, the user will be created in an inactive state and must be manually activated by an admin before they can access VaultOne.
