JumpCloud

This page shows how to let people sign in to MicroB2B with JumpCloud. It also shows how JumpCloud service accounts, such as AI agents, call the REST API. Read identity providers first for the concepts.

This setup is not verified against a JumpCloud tenant. The menu names below follow JumpCloud’s documentation for custom OIDC applications. They may differ in your console version. Any provider that speaks standard OpenID Connect with JWT access tokens works the same way.

The examples use MicroB2B at https://b2b.example.com and the provider name jumpcloud in MicroB2B.

Create the application in JumpCloud

1. In the admin console, go to SSO applications, click Add New Application and choose Custom OIDC App.
2. Set Redirect URIs to https://b2b.example.com/ui/auth/jumpcloud/callback.
3. Set the client authentication type to Client Secret Basic or Client Secret Post. Both work.
4. Choose the scopes openid, profile and email.
5. Save, then copy the Client ID and Client Secret.
6. Assign the application to the user groups that may sign in to MicroB2B. Every MicroB2B user is an administrator.

Add the provider in MicroB2B

1. Go to Access > Identity providers and click New identity provider.

2. Fill in:

   Setting	Value
   Name	jumpcloud
   Display Name	for example JumpCloud
   Issuer URL	https://oauth.id.jumpcloud.com/
   Client ID	the client ID from JumpCloud
   Client Secret	the client secret from JumpCloud

3. Save.

4. Sign out, then click Sign in with JumpCloud on the login page.

Keep the trailing slash in the issuer URL. It must match JumpCloud’s discovery document exactly.

JumpCloud service accounts

JumpCloud service accounts let machines, such as AI agents, call APIs. Their tokens come from a different issuer than people’s sign-ins: https://admin-oauth.id.jumpcloud.com/. So they need a second identity provider in MicroB2B.

Their tokens carry an empty audience (aud: []). They name the service account in sub, as an id like sa_....

1. Go to Access > Identity providers and click New identity provider. Fill in:

   Setting	Value
   Name	for example jumpcloud-sa
   Display Name	for example JumpCloud service accounts
   Offer sign-in	off
   Issuer URL	https://admin-oauth.id.jumpcloud.com/ (with the trailing slash)
   Accept tokens without an audience	on

   A provider without sign-in needs no client ID or secret.

2. Go to Access > Service accounts and click New service account. For each JumpCloud service account:

   • set Kind to Federated (identity provider),
   • set Identity provider to jumpcloud-sa,
   • set Subject to its sa_... id.

3. The agent calls the API with Authorization: Bearer <JumpCloud access token>.

Only registered subjects are accepted. Every JumpCloud customer shares the admin-oauth issuer. Registering each sa_... id ties the tokens to your organization.

Use such an account for MicroB2B alone. Its tokens have no audience. Any other service the account sends its token to could replay it to MicroB2B.

See service accounts for more about federated service accounts.