#Authentication

Authentication controls how users prove their identity before they reach JumpServer. The page starts with a Basic tab of global options, followed by an Integration tab where authentication methods are enabled, and a tab for each enabled method.

#Basic settings

#Supported methods

#Multi-factor authentication

MFA (Multi-Factor Authentication) user settings follow the system configuration by default. Authentication methods that are not enabled at the system level are clearly marked in the user's MFA settings. When MFA is enforced system-wide, it is enabled automatically for every user and cannot be disabled.

The system-wide MFA policy is configured in Security.

#Enable an authentication method

1

In the right area of the top navigation bar, click .

2

In the left menu, click Authentication.

3

Open the Integration tab and select the method you want to enable.

4

Open the method's tab and complete the provider connection fields: server URL or issuer, client ID and client secret, and the protocol-specific settings.

5

Define the attribute mapping so that provider attributes are written to the JumpServer user name, name, and email fields.

6

Optionally choose the organization that authenticated users join, and whether JumpServer should create users that do not exist yet.

7

Click Submit, then test the sign-in flow from a private browser window.

#Protocol details

Each method tab follows the same shape, with protocol-specific fields:

• LDAP and LDAP HA require a bind DN, bind password, user OU, user filter, and attribute mapping. Use Test connection, Test login, User import, and Sync settings at the bottom of the tab. User groups can be mapped through distinguishedName.
• CAS requires the CAS server address, service URL, version, and attribute mapping. Add the login, callback, and logout URLs to the CAS client.
• OIDC requires the client ID and secret, either a Keycloak server and realm or explicit authorization, token, JWKS, userinfo, and logout endpoints.
• SAML2 requires the SP key and certificate, and either the IdP metadata URL or metadata XML. Download the SP metadata to configure the identity provider.
• OAuth2 requires the authorization, token, userinfo, and logout endpoints, plus scopes and a client authentication method.
• RADIUS requires host, port, and shared secret. Enable the RADIUS OTP option to use it as an MFA backend.
• Passkey requires HTTPS access and a valid domain list for the relying party.

#Version history

#Related topics

• Security
• Basic settings
• Users
• Profile