Configuration of single sign-on in JumpCloud

• Nebius AI Cloud, where you create and configure a federation.
• , where you create an application, make it available to the users for whom you configure SSO, and connect the to the federation.

​

Costs

​

Prerequisites

1. Create a JumpCloud account.
2. Make sure that this account has at least the Administrator role.
3. Make sure that your Nebius AI Cloud account is added to the tenant’s group of administrators. To check this, in the web console, go to  Administration → IAM → Users.
4. If you prefer not to use the web console, prepare one of the other available Nebius AI Cloud interfaces:
   • CLI
   • Terraform

   Install and configure the Nebius AI Cloud CLI.

   Install and configure the Nebius AI Cloud provider for Terraform.

​

Steps

​

Create an application in JumpCloud

1. Sign in to the JumpCloud admin portal.
   If your data is stored in the EU, you have a different login URL: https://console.eu.jumpcloud.com/login
2. Create and configure a custom SSO application:
   1. In the admin portal, go to Access → Applications and click  Add New Application.
   2. In the window that opens, select Custom Application, then select Manage Single Sign-On (SSO) with Configure SSO with SAML.
   3. Enter a name for your application in the Display Label field. You can optionally add a description for your application and upload a logo or select a different color indicator.
   4. On the SSO tab of your application, specify the following required parameters:
      • IdP Entity ID: Click Copy Metadata URL and paste the value in this field.
      • SP Entity ID: https://auth.eu.nebius.com/saml2/rp/federation-id
      • ACS URLs: https://auth.nebius.com/login/saml2/provider/federation-id
        federation-id is used temporarily until you create a federation and get its ID. After that, replace federation-id with the actual value.
      • SAMLSubject NameID: email
      • SAMLSubject NameID Format: urn:oasis:names:tc:SAML:1.0:nameid-format:unspecified
      • Signature Algorithm: RSA-SHA256
      • Sign: Response
      Click Save to apply the changes.
3. Create users, then add users to a user group.

​

Download the application certificate from JumpCloud

1. Go to your application settings in the JumpCloud admin portal.
2. Click Actions → Download Certificate to download and save the certificate.

​

Create a federation in Nebius AI Cloud

1. To create a federation:
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. Click Create entity and select Federation.
   3. Click the Manual mode toggle and enter your federation name.
   4. Specify the following parameters under Identity provider (IdP):
      • SSO URL: Go to the SSO tab of your JumpCloud application settings and copy and paste the value from the IdP URL field.
      • Issuer: In the same tab in JumpCloud, click Copy Metadata URL and paste the value in this field.
   5. Enter a name for your certificate.
   6. Upload the certificate file that you obtained in the previous step and click Create federation. Copy the ID of the newly created federation.

   1. Run the following command:
      nebius iam federation create \
        --parent-id <tenant_ID> \
        --name <federation_name> \
        --user-account-auto-creation=true \
        --saml-settings-sso-url <Login_URL> \
        --saml-settings-idp-issuer <Identity_Provider_Identifier>
      
      The command contains the following parameters:
      • --parent-id: Tenant ID.
      • --name: The federation name.
      • --user-account-auto-creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • --saml-settings-sso-url: Login URL from JumpCloud.
      • --saml-settings-idp-issuer: JumpCloud identifier. To get values for --saml-settings-sso-url and --saml-settings-idp-issuer:
        1. Open the application settings page in the JumpCloud admin portal.
        2. Go to the SSO tab and copy the values of the IdP URL and IdP Entity ID fields.
   2. Copy and save the federation ID. It is returned in the metadata.id field of the command output.

   1. Create the following configuration file:
      resource "nebius_iam_v1_federation" "<federation_name>" {
        name                       = "<federation_name>"
        parent_id                  = "<tenant_ID>"
        user_account_auto_creation = true
        saml_settings = {
          sso_url    = "<login_URL>"
          idp_issuer = "<JumpCloud_identifier>"
        }
      }
      
      output "federation_id" {
        description = "ID of the created federation"
        value = nebius_iam_v1_federation.<federation_name>.id
      }
      
      The file contains a resource with federation settings and an output that returns the federation ID. The resource contains the following parameters:
      • name: The federation name.
      • parent_id: Tenant ID.
      • user_account_auto_creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • saml_settings.sso_url: Login URL from JumpCloud.
      • saml_settings.idp_issuer: JumpCloud identifier. To get values for saml_settings.sso_url and saml_settings.idp_issuer:
        1. Open the application settings page in the JumpCloud admin portal.
        2. Go to the SSO tab and copy the values of the IdP URL and IdP Entity ID fields.
   2. Check that the configuration is correct:
      terraform validate
      
   3. Apply the changes:
      terraform apply
      
   4. Copy and save the federation ID. It is returned in the terraform apply output:
      Outputs:
      
      federation_id = "federation-e00*******"
      
2. Update the SSO settings of your application in the JumpCloud admin portal:
   1. Open the application settings page and go to the SSO tab.
   2. In the fields SP Entity ID and ACS URLs, replace the federation-id part of the values with the copied federation ID.

​

Add a certificate to the federation

​

Log in to Nebius AI Cloud

1. Open the Nebius AI Cloud web console.
2. Click Get started with SSO.
3. Enter the federation ID and click Sign in.
4. In the Contact details window that opens:
   1. Specify your name and email.
   2. Confirm that you agree with the Nebius AI Cloud Terms of Use.
   3. Click Continue.

​

Assign administrator rights for the new account

1. Log out of your new account in the web console.
2. Log in to your main Nebius AI Cloud account.
3. Go to  Administration → IAM → Users and add the new user to the relevant admin group.