All Collections
Integrations
Connecting Single Sign-On (SSO/SAML) & Juro
Connecting Single Sign-On (SSO/SAML) & Juro

Integrate Juro with your SSO platform to automate platform access and streamline account creation

Tom Langley avatar
Written by Tom Langley
Updated over a week ago

Contents 🚀

  1. Introduction

  2. Enabling SSO/SAML

    1. For Okta customers

    2. For Microsoft SSO (e.g. Azure, Entra, ADFS) customers

    3. Customers using other SSO providers (e.g. JumpCloud, OneLogin) 🌞

  3. Enabling provisioning

    1. Setup

    2. Features supported by SCIM

  4. Enforcing SSO logins

Introduction 👋

Juro offers SSO/SAML across SSO providers and SCIM for Okta customers specifically.

Connecting Juro with your SSO platform lets you automate platform access, streamline account creation and enhance your security profile. On top of that, it'll save all of your teams time when it comes to accessing Juro.
​
Juro offers SSO/SAML across SSO providers and SCIM for Okta customers specifically.

Enabling SSO/SAML 🔑

💡 NOTE: Only users with Organisation Admin privileges in Juro and your SSO platform can enable SSO/SAML for your Juro environment.

For Okta customers ☀️

To enable SSO through your Okta instance:

  1. Go to Juro's Okta integration on Okta's website

  2. Click + Add Integration and select your Okta org

  3. Set the subdomain to app

  4. Navigate to the added application configuration, go the Sign On tab and click on View Setup Instructions: you'll be directed to a page similar to this one

  5. Contact either your Juro Legal Engineer or the Juro Support Team (by clicking the Intercom icon in the bottom right-hand corner of this tab) and provide them with the IDP Metadata URL from the Setup Instructions page:

The Juro Team will now enable SSO for your organisation from our side. Once this is done, your users can log in to Juro using their existing credentials by clicking Continue with SAML SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

For Microsoft SSO (e.g. Azure, Entra, ADFS) customers 🌔

💡 NOTE: As well as being an Org Admin in Juro, you'll need to be a Cloud Application Administrator in your Microsoft SSO environment.

To enable SSO through Azure, in your Azure Active Directory:

  1. Click Enterprise Applications, then + New application and finally + Create your own application

  2. Set "Juro" as the Input name and check the Integrate any other application you don't find in the gallery (Non-gallery) option.

  3. Click Manage, then Single sign-on and select SAML

  4. In the Basic SAML Configuration panel on the right, configure the following Juro-related information:

    • Identifier (Entity ID): https://app.juro.io

    • Reply URLs (Assertion Consumer Service URL):

      https://app.juro.com/api/auth/saml/callback
      https://app.juro.com/api/auth/saml/onboarding/callback
      https://sandbox.juro.io/api/auth/saml/callback
      https://sandbox.juro.io/api/auth/saml/onboarding/callback
      https://test.juro.io/api/auth/saml/callback
      https://test.juro.io/api/auth/saml/onboarding/callback
      https://preprod.juro.io/api/auth/saml/callback
      https://preprod.juro.io/api/auth/saml/onboarding/callback

  5. Make sure to set https://app.juro.com/api/auth/saml/callback as the default

  6. Now, you'll need to configure the Attributes & Claims, and input the following information into the Claim name which is under Additional claims:

    • For email, the value will be user.mail.

    • For firstName, the value will be user.givenname

    • For lastName, the value will be user.surname

  7. Finally, locate the App Federation Metadata Url. You can find this by going to the SAML Signing Certificate section.

  8. On the SAML Signing Certificate page, copy the App Federation Metadata Url

Contact either your Juro Legal Engineer or Juro's Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab), and provide the App Federation Metadata Url. The Juro Team will now enable SSO for your organisation from our side. Once this is done, your users can log in to Juro using their existing credentials by clicking Continue with SAML SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

Customers using other SSO providers (e.g. JumpCloud, OneLogin) 🌞

In your SSO platform:

  1. Find the Metadata URL: if you cannot find this, please find the:

    • SSO URL

    • Issuer ID, and

    • Certificate string

  2. Contact either your Juro Legal Engineer or Juro's Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab), and provide the data points from Step 1.

The Juro Team will now enable SSO for your organisation from our side. Once this work is complete, within your SSO platform:

  1. Configure a Claim nameID with the user's email as the value

  2. Configure the following Juro-related information:

  3. Whitelist the following Juro ACS URLs on your side (this is required to enable different environments):

https://app.juro.com/api/auth/saml/callback
https://app.juro.com/api/auth/saml/onboarding/callback
https://sandbox.juro.io/api/auth/saml/callback
https://sandbox.juro.io/api/auth/saml/onboarding/callback
https://test.juro.io/api/auth/saml/callback
https://test.juro.io/api/auth/saml/onboarding/callback
https://preprod.juro.io/api/auth/saml/callback
https://preprod.juro.io/api/auth/saml/onboarding/callback

If you need a regex for whitelisted URLs: ^https:\/\/(app|preprod|sandbox|test)\.juro\.(io|com)\/api\/auth\/saml\/(onboarding\/)?callback$

Your users can now log in to Juro using their existing credentials by clicking Continue with SAML SSO after they have been added to the Juro through Settings > Members & Groups > + Add Members.

Enabling provisioning 🏁

Once SSO/SAML is enabled, you may want the users added to your SSO platform to also be automatically added to Juro. This can be achieved through provisioning, which allows you to select a team and permissions set to be applied to all new users added to your SSO platform.
​

To enable provisioning:

  1. Confirm which Juro team you'd like to add all new users to

  2. Confirm which permissions set you'd like new users to have

    e.g. new users are added to the "General" team with the "User" permission set

  3. Contact either your Juro Legal Engineer or the Juro Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab) and let them know that you'd like to enable provisioning for your environment.

We'll get back in touch to let you know when provisioning has been enabled (don't worry, this won't take too long). Once provisioning has been enabled, any new members added to your SSO platform will be added to Juro automatically.

Enabling SCIM provisioning 🤖

💡 NOTE: SCIM provisioning can be enabled for Okta customers only.

Setup 🔧

SCIM allows for a more granular approach to provisioning. You may want to add members from different departments to the corresponding Teams in Juro, with the relevant permission set. e.g., add members of your Sales Team to the Sales Team only in Juro as "Users" and members of your People Team to be added to the People Team only in Juro with "Editor" access.

To enable SCIM provisioning:

  1. Contact either your Juro Legal Engineer or the Juro Support Team (which you can do by clicking the Intercom icon in the bottom right-hand corner of this tab) and request for SCIM provisioning to be enabled

  2. Once enabled, we will provide you with a unique API key and a base URL 

    https://app.juro.com/xapi/scim (base URL)

  3. In Okta, go to the To App provisioning settings

  4. Enable the Create Users, Update User Attributes and Deactivate Users options

  5. Select email as the Application username format in the Sign On applications tab
    ​

  6. Set the user access levels via the accessLevelName attribute. Supported values for this attribute are:

    • org_admin: assigns Admin access in all teams, as well as Organisation Admin access

    • team_admin: assigns Admin access in all teams, but not Organisation Admin access

    • team_editor: assigns Editor access in all teams, but not Organisation Admin access

    • team_user: assigns User access in all teams, but not Organisation Admin access

    • app_managed: assigns User access in all teams for the onboarding stage, but not Organisation Admin access. After this, permissions assigned using this attribute will be controlled from the Teams or Members tabs in Juro;

    If this attribute is not set, the default value is considered to be app_managed.

  7. Optional: Assign users to the Juro app. For more information on this step, please visit this page.

Features supported by SCIM 🏋️

The following provisioning features are supported through SCIM:

  • Push New Users: users created in Okta are also created in Juro and added to your organization

  • Push Profile Updates: updates made to the Okta user profile are pushed to Juro

    💡 NOTE: the userName attribute update operation is not supported (whenever this attribute is updated a new user will be created instead). The email attribute is also not supported.

  • Push Groups: groups (and their members) in Okta are synchronized to Juro as Juro Teams

  • Import New Users: new users created in Juro will be downloaded and turned into new AppUser objects, for matching against existing Okta users

  • Import Groups: Juro Teams from your organization will be imported into Okta as groups

  • Push User Deactivation: deactivating a user or disabling application access in Okta removes the user from all assigned teams in your Juro organization.

Enforcing SSO logins ⏬

You might want to enforce single sign-on (SSO) logins by disabling username/password or specific login methods like Google SSO. It's recommended to do this only when SSO is fully operational for your Juro workspace.

Contact your Juro Legal Engineer or the Juro Support Team to enforce SSO logins. You can reach them by clicking the Intercom icon in the bottom right-hand corner of this tab and informing them of the following information:

  • If SSO has been set up and fully configured for your Juro Workspace

  • Which login methods to disable (Google, username/password, both etc)

💁‍♂️ As always, our Support Team is happy to help you with anything further if needed. Start a chat with us right here by clicking the Intercom button in the bottom-right-hand corner of this page.

Alternatively, you can email your query to support@juro.com 🚀

Did this answer your question?