JumpCloud
Create a custom OpenID Connect application in JumpCloud, include the group attribute, and connect it for single sign-on.
Costfluent signs your people in through JumpCloud over OpenID Connect. You create one custom OIDC application in JumpCloud, and Costfluent trusts the addresses at the domains you verify.
Before you start
- You need the Owner organization role in Costfluent, and a JumpCloud administrator who can add SSO applications.
- Your people's addresses are at a domain you can publish a DNS TXT record for.
Available on the Core, Optimize and Scale plans. Compare plans
This page follows JumpCloud's own documentation. Costfluent has not been tested against JumpCloud yet.
Register the application
- In the JumpCloud Admin Portal, add a custom OIDC application under SSO applications.
- Add the redirect URI
https://app.costfluent.com/api/auth/sso/callback. - Choose client secret post as the client authentication type: Costfluent sends the secret in the body of the token request.
- Map the standard
emailandprofilescopes, bind the user groups who should sign in, and save. Copy the client ID and the client secret, which JumpCloud shows once.
Your discovery URL is https://oauth.id.jumpcloud.com/.well-known/openid-configuration, or https://oauth.id.eu.jumpcloud.com/.well-known/openid-configuration for an organization in JumpCloud's EU region.
Send groups
- In the application's attribute settings, include the group attribute.
- Name it
groups, or set the name you choose as the connection's groups claim in Costfluent.
The Identity provider group you map in Costfluent is the group name as JumpCloud sends it.
Connect in Costfluent
- Open Settings, then Single sign-on, and connect your provider with the discovery URL, the client ID and the client secret.
- Add your email domains to the connection and verify each with its DNS TXT record.
- Map the groups to teams, then enable the connection.
Sign-in and security covers each of these steps, enforcement and break-glass Owners.
How it behaves
Costfluent reads these claims from the ID token, and from the userinfo endpoint where the ID token leaves one out:
iss, which must equal the issuer your discovery document named when you connected it.sub, the JumpCloud user ID, as the identity Costfluent keeps.email, which must be at one of the connection's verified domains. JumpCloud is one issuer for every JumpCloud organization in a region, so the verified domain is what keeps out a user of another organization: an address outside every verified domain is refused, and so is a sign-in without an address.name, for the name of an account Costfluent creates.groups, or another claim name you set on the connection.
Costfluent also refuses a token whose signature, audience, nonce or lifetime does not check out, and a discovery document that starts naming another issuer.