Skip to content
Subnoto Logo Subnoto Documentation

SSO with JumpCloud

This guide walks you through setting up SSO with JumpCloud. You will create a Custom OIDC application and use the Redirect URI: https://app.subnoto.com/auth/oidc.

Use the issuer for the region where your JumpCloud organization is hosted. The issuer includes a trailing slash.

RegionIssuer URL
United Stateshttps://oauth.id.jumpcloud.com/
European Unionhttps://oauth.id.eu.jumpcloud.com/
Indiahttps://oauth.id.in.jumpcloud.com/

Step 1: Sign in to the JumpCloud Admin Portal

  • Log in to the JumpCloud Admin Portal.
  • If your organization is hosted in the EU or India, use the regional admin portal for that data center.

Step 2: Create a Custom OIDC application

  • Go to Access > SSO Applications.
  • Click + Add New Application.
  • Search for OIDC and select Custom OIDC App, or choose Custom Application and then Configure SSO with OIDC.
  • Enter a display label, such as Subnoto.
  • Click Next, then Configure Application.

Step 3: Configure SSO

On the SSO tab:

  • Leave Authorization Code selected.
  • Add the redirect URI: https://app.subnoto.com/auth/oidc.
  • Set Client Authentication Type to Client Secret POST.
  • Leave Subject Claim as JumpCloud User ID.
  • Under attribute mapping, enable the Email and Profile scopes. Subnoto needs the email claim to match the member’s account.
  • In Login URL, paste the Login URL from your configuration in Subnoto SSO settings. This lets users open Subnoto from the JumpCloud User Portal. You can add it after the Subnoto configuration exists.
  • Click Activate.

Copy the Client ID and Client Secret when JumpCloud shows them. The secret is shown only once.

Step 4: Assign users

  • Open the application and go to User Groups.
  • Select at least one group whose members should sign in to Subnoto.
  • Save the assignment.

Step 5: Add the configuration in Subnoto

In Subnoto SSO settings, create a configuration:

  • Client ID and Client Secret: the values copied from JumpCloud.
  • Issuer URL: the regional issuer from the table above, including the trailing slash. You can also paste the regional discovery URL and click Fetch configuration automatically:
    • United States: https://oauth.id.jumpcloud.com/.well-known/openid-configuration
    • European Union: https://oauth.id.eu.jumpcloud.com/.well-known/openid-configuration
    • India: https://oauth.id.in.jumpcloud.com/.well-known/openid-configuration
  • Keep the default scopes openid, email, and profile.

Fetching the discovery document fills the authorization, token, userinfo, revocation, and JWKS endpoints, and sets the issuer to the value JumpCloud publishes.

Use Test SSO on the configuration before enabling it for the team. The test confirms that JumpCloud returns an email claim and that it matches the admin account running the test.

Back to SSO overview