JumpCloud SSO Support

[hakmkoyan]

Hi.
Does your application support Single Sign On for JumpCloud Custom SAML app, if you answer is yes, below will be my info about my mess in that with all configurations that I have, can you help me with that mess?
So here is the thing, I created custom SAML app in JumpCloud, provided configurations in argocd chart's values.yaml file undex dex.config like this one below:

url: "https://localhost:8080"
dex.config: |
connectors:
- type: saml
id: jumpcloud
name: JumpCloud
config:
ssoURL: https://sso.jumpcloud.com/saml2/saml2
caData: |
usernameAttr: username
emailAttr: email
groupsAttr: group

And here is the configuration of JumpCloud custom SAML app :
IdP Entity ID: jumpcloud
SP Entity ID: https://localhost:8080/api/dex
ACS URL: https://localhost:8080
SAMLSubject NameID: email
SAMLSubject NameID Format: urn:oasis:names:tc:SAML:1.0:nameid-format:unspecified
Signature Algorithm: RSA-SHA256
Login URL: https://localhost:8080
IDP URL: https://sso.jumpcloud.com/saml2/saml2
User Attributes:
usernameAttr: username
emailAttr: email

So, after these all, I installed argocd chart with custom values.yaml file, it ran perfectly, BUT, when I clicked Login via JUMPCLOUD, At first it asked me my jumpcloud username-password, I entered, after that it again redirected me to login page.
The same thing happens when I call command from CLI argocd login localhost:8080 --sso --insecure.

I want to understand, does this all mess happens because ArgoCD doesn't support JumpCloud or it is my fault?

[jessesuen]

We support SAML through the use of https://dexidp.io/. So the answer to your question is really if dex can support it. Based on a basic search in their git repo, it does appear others are using it.

https://github.com/dexidp/dex/search?q=jumpcloud&type=issues

[mconigliaro]

FWIW, here's a JumpCloud config that worked for me:

logger:
  level: debug
connectors:
  - type: saml
    id: jumpcloud
    name: JumpCloud
    config:
      ssoURL: https://sso.jumpcloud.com/saml2/argocd
      caData: |
        <your base64 encoded certificate data>
      usernameAttr: username
      emailAttr: email
      groupsAttr: memberOf

On the JumpCloud side, I set the following fields on the SSO tab of my app:

Name	Value	Notes
IdP Entity ID	https://example.com/api/dex/callback	Dex callback endpoint of your Argo CD server
SP Entity ID	https://example.com/api/dex/callback	Dex callback endpoint of your Argo CD server
ACS URL	https://example.com/api/dex/callback	Dex callback endpoint of your Argo CD server
IDP URL	https://sso.jumpcloud.com/saml2/argocd	Corresponds with ssoURL above

Note that JumpCloud doesn't seem to send any attributes by default, which will probably result in Failed to authenticate: response did not contain a AttributeStatement in your Dex logs. I fixed this by going into the SSO tab of my app and setting the following attributes:

Service Provider Attribute Name	JumpCloud Attribute Name	Notes
username	username	Corresponds with usernameAttr above
email	email	Corresponds with emailAttr above

I also enabled "include group attribute" under "GROUP ATTRIBUTES" with a value of memberOf (to match the groupsAttr above). This is needed if you want to use JumpCloud's groups in your RBAC config.

Next I had to kill my argocd-server pod and clear the cookies on my browser (not sure why, but the "LOG IN VIA JUMPCLOUD" button just kept redirecting me back to the login page until I did this). Now I get messages like this in my Dex logs and everything seems to be working:

time="2023-02-27T18:51:34Z" level=info msg="login successful: connector \"jumpcloud\", username=\"example\", preferred_username=\"\", email=\"example@example.com\", groups=[\"foo\", \"bar\"]"

[mconigliaro]

@joonvena yes, it seems to be working for us. IIRC, step 1.d was the key to get the list of groups for each user.

[joonvena]

Strange i did enable Enable group attribute and gave it value groups when creating the OIDC application in Jumpcloud but can't see any groups in ArgoCD when logged in. 🤔

[mconigliaro]

@joonvena after I log in, I click "User Info" and it shows a list of all the groups my account is associated with.

[joonvena]

Yes this is how it works when i'm using eg. Gitlab with OIDC i can see the group info in the User info tab. With Jumpcloud there is nothing. I checked logs from argocd-server pod and looking at the OIDC auth related data there is no groups included in the payload.

[mconigliaro]

Total guess, but I wonder if there's another step on the JumpCloud side to include the group attribute. I thought Argo CD expected an attribute named groups by default, but maybe that's configurable too.