Skip to content
FreesbeFreesbe DocsBack to freesbe.net

Set up single sign-on with JumpCloud

How-toFor adminsReviewed Guides: Single sign-on, Admin Center

Connect JumpCloud so people sign in to Freesbe with their JumpCloud account, and JumpCloud’s user groups decide who gets in.

Before you start

Section titled “Before you start”
  • Single sign-on with your own provider comes with the Corporate and Enterprise plans.
  • Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
  • You need to be an owner of the workspace in Freesbe, and able to add apps in JumpCloud.
  • Keep the Freesbe page open in one tab and JumpCloud in another: you copy details both ways.

1. Start in Freesbe

Section titled “1. Start in Freesbe”
  1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
  2. Choose JumpCloud and SAML 2.0, then Set up JumpCloud.
  3. The page shows Add Freesbe to JumpCloud with the details to copy. Leave it open.

2. Add Freesbe to JumpCloud

Section titled “2. Add Freesbe to JumpCloud”
  1. In the JumpCloud Admin Portal, go to SSO Applications and click Add New Application. Choose Custom Application, then Manage Single Sign-On (SSO) with Configure SSO with SAML, and name it Freesbe.
  2. On the SSO tab, enter an IdP Entity ID (for example jumpcloud-freesbe), paste Freesbe’s Entity ID into SP Entity ID and its Reply URL into ACS URLs.
  3. Set SAMLSubject NameID to email. Optionally add firstname and lastname attributes.
  4. On User Groups, pick the groups who use Freesbe, and Save.
  5. Open the app again and click Export Metadata to download its metadata file.

3. Tell Freesbe about JumpCloud

Section titled “3. Tell Freesbe about JumpCloud”

Under Tell Freesbe about JumpCloud, choose Metadata file, pick the exported file and click Save.

4. Test it

Section titled “4. Test it”
  1. Back on the Freesbe page, under Test it, click Test sign-in.
  2. Sign in to JumpCloud as yourself. You’re brought back to the page, which says Signed in and shows what JumpCloud sent: your email address, name and any other attributes.
  3. Nobody else can sign in through JumpCloud until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

Section titled “If the test doesn’t sign in”

The page says why. The usual reasons:

  • “isn’t at one of this workspace’s verified email domains”: JumpCloud sent an address at another domain, or a username instead of the email. Send the user’s primary email as the SAMLSubject NameID (email).
  • “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one JumpCloud signs with. Paste the metadata URL again, or upload the new metadata file.
  • “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in JumpCloud doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
  • “is encrypted”: turn off assertion encryption for the Freesbe app.
  • The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in JumpCloud.

See Single sign-on for everything else.

With OpenID Connect instead

Section titled “With OpenID Connect instead”

Choose OpenID Connect in step 1, and in JumpCloud configure the custom application with OIDC: paste Freesbe’s Redirect URL under Redirect URIs, use Client Secret Basic or Post, and include the email scope. In Freesbe enter the issuer https://oauth.id.jumpcloud.com/, the client ID and the client secret.