Skip to main content

Connecting Single Sign-On (SSO/SAML) & Juro

Integrate Juro with your SSO platform to automate platform access and streamline account creation

Tom Langley avatar
Written by Tom Langley
Updated this week

Contents 🚀

  1. Introduction

  2. Enabling SSO/SAML

    1. For Okta customers

    2. For Microsoft SSO (e.g. Azure, Entra, ADFS) customers

    3. Customers using other SSO providers (e.g. JumpCloud, OneLogin) 🌞

  3. Enabling provisioning

    1. Setup

    2. Features supported by SCIM

  4. Enforcing SSO logins

Introduction 👋

Juro offers SSO/SAML across SSO providers and SCIM for Okta customers specifically.

Connecting Juro with your SSO platform lets you automate platform access, streamline account creation and enhance your security profile. On top of that, it'll save your teams time when accessing Juro.
​
Juro offers SSO/SAML across SSO providers and SCIM for Okta customers specifically.

Enabling SSO/SAML 🔑

💡 NOTE: Only users with Organisation Admin privileges in Juro and your SSO platform can enable SSO/SAML for your Juro environment.

For Okta customers ☀️

To enable SSO through your Okta instance:

  1. Go to Juro's Okta integration on Okta's website

  2. Click + Add Integration and select your Okta org

  3. Set the subdomain to app

  4. Navigate to the added application configuration, go to the Sign On tab and click on View Setup Instructions: you'll be directed to a page similar to this one

  5. Contact the Juro Support Team (by clicking the Intercom icon in the bottom right-hand corner of this tab) and provide them with the IDP Metadata URL from the Setup Instructions page:

The Juro Team will now enable SSO for your organisation from our side.

Once this is done, your users can log in to Juro using their existing credentials by clicking Sign in with SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

For Microsoft SSO (e.g. Azure, Entra, ADFS) customers 🌔

💡 NOTE: As well as being an Org Admin in Juro, you'll need to be a Cloud Application Administrator in your Microsoft SSO environment.

To enable SSO through Azure, in your Azure Active Directory:

  1. Click Enterprise Applications, then + New application and finally + Create your own application

  2. Set "Juro" as the Input name and check the Integrate any other application you don't find in the gallery (Non-gallery) option.

  3. Click Manage, then Single sign-on and select SAML

  4. In the Basic SAML Configuration panel on the right, configure the following Juro-related information:

    • Identifier (Entity ID): https://app.juro.io

    • Reply URLs (Assertion Consumer Service URL):

      https://app.juro.com/api/auth/saml/callback
      https://app.juro.com/api/auth/saml/onboarding/callback
      https://sandbox.juro.io/api/auth/saml/callback
      https://sandbox.juro.io/api/auth/saml/onboarding/callback
      https://test.juro.io/api/auth/saml/callback
      https://test.juro.io/api/auth/saml/onboarding/callback
      https://preprod.juro.io/api/auth/saml/callback
      https://preprod.juro.io/api/auth/saml/onboarding/callback

  5. Make sure to set https://app.juro.com/api/auth/saml/callback as the default

  6. Now, you'll need to configure the Attributes & Claims, and input the following information into the Claim name which is under Additional claims:

    • For email, the value will be user.mail.

    • For firstName, the value will be user.givenname

    • For lastName, the value will be user.surname

  7. Finally, locate the App Federation Metadata Url. You can find this by going to the SAML Signing Certificate section.

  8. On the SAML Signing Certificate page, copy the App Federation Metadata Url

Contact Juro's Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab), and provide the App Federation Metadata Url. The Juro Team will now enable SSO for your organisation from our side.

Once this is done, your users can log in to Juro using their existing credentials by clicking Sign in with SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

Customers using other SSO providers (e.g. JumpCloud, OneLogin) 🌞

In your SSO platform:

  1. Find the Metadata URL: if you cannot find this, please find the:

    • SSO URL

    • Issuer ID, and

    • Certificate string

  2. Contact Juro's Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab), and provide the data points from Step 1.

The Juro Team will now enable SSO for your organisation from our side. Once this work is complete, within your SSO platform:

  1. Configure a Claim nameID with the user's email as the value

  2. Configure the following Juro-related information:

  3. Whitelist the following Juro ACS URLs on your side (this is required to enable different environments):

https://app.juro.com/api/auth/saml/callback
https://app.juro.com/api/auth/saml/onboarding/callback
https://sandbox.juro.io/api/auth/saml/callback
https://sandbox.juro.io/api/auth/saml/onboarding/callback
https://test.juro.io/api/auth/saml/callback
https://test.juro.io/api/auth/saml/onboarding/callback
https://preprod.juro.io/api/auth/saml/callback
https://preprod.juro.io/api/auth/saml/onboarding/callback

If you need a regex for whitelisted URLs: ^https:\/\/(app|preprod|sandbox|test)\.juro\.(io|com)\/api\/auth\/saml\/(onboarding\/)?callback$

Once this is done, your users can log in to Juro using their existing credentials by clicking Sign in with SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

Enabling provisioning 🏁

Once SSO/SAML is enabled, it is possible to set up Just-In-Time provisioning where new users can be assigned to a group when logging in via SSO for the first time.
​

To enable Just-In-Time provisioning:

  1. Confirm which Juro group you would like to add all new users to

  2. Contact the Juro Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab) and let them know that you'd like to enable provisioning for your environment.

We'll get back in touch to let you know when provisioning has been enabled (don't worry, this won't take too long). Once provisioning has been enabled, all new users will be assigned to a group of your choice when logging in for the first time.

Enabling SCIM provisioning 🤖

💡 NOTE: SCIM provisioning can be enabled for Okta customers only.

Setup 🔧

SCIM allows for a more granular approach to provisioning. SCIM allows you to add members to specific groups from Okta into Juro.

To enable SCIM provisioning:

  1. Contact the Juro Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab) and request for SCIM provisioning to be enabled

  2. Once enabled, we will provide you with a unique API key and a base URL 

    https://app.juro.com/xapi/scim (base URL)

  3. In Okta, go to the To App provisioning settings

  4. Enable the Create Users, Update User Attributes and Deactivate Users options

  5. Select email as the Application username format in the Sign On applications tab
    ​

  6. Using the accessLevelName attribute, you can set someone as an Org Admin using the org_admin attribute.

  7. Optional: Assign users to the Juro app. For more information on this step, please visit this page.

Features supported by SCIM 🏋️

The following provisioning features are supported through SCIM:

  • Push New Users: users created in Okta are also created in Juro and added to your organization

  • Push Profile Updates: updates made to the Okta user profile are pushed to Juro

💡 NOTE: the userName attribute update operation is not supported (whenever this attribute is updated a new user will be created instead). The email attribute is also not supported.

  • Push Groups: groups (and their members) in Okta are synchronized to Juro as Juro Groups.

  • Import New Users: new users created in Juro will be downloaded and turned into new AppUser objects, for matching against existing Okta users

  • Import Groups: Juro Groups from your organization will be imported into Okta as groups

  • Push User Deactivation: deactivating a user or disabling application access in Okta removes the user from all assigned groups in your Juro organization.

Enforcing SSO logins ⏬

You may choose to enforce single sign-on (SSO) logins by disabling username/password or specific login methods like Google SSO. It's recommended to do this only when SSO is fully operational for your Juro workspace.

Contact the Juro Support Team to enforce SSO logins. You can reach them by clicking the Intercom icon in the bottom right-hand corner of this tab and informing them of the following information:

  • If SSO has been set up and fully configured for your Juro Workspace

  • Which login methods to disable (Google, username/password, both etc)

💁‍♂️ As always, our Support Team is happy to help you with anything further if needed. Start a chat with us right here by clicking the Intercom button in the bottom-right-hand corner of this page.

Alternatively, you can email your query to support@juro.com 🚀

Did this answer your question?