This article is also available in:

SAML SSO JumpCloud

🔑 SAML SSO JumpCloud

"Enable secure single sign-on with JumpCloud and Brainframe GRC."
Follow these steps to configure SAML authentication between your JumpCloud tenant and Brainframe GRC.

1️⃣ Create the Application

Go to the JumpCloud admin console → User Authentication → SSO Applications and click Add New Application.

Click "Select" on Custom Application, and click Next on the following screen

Select Manage Single Sign-On (SSO) and Configure SSO with SAML

Enter the application name "Brainframe GRC", and enter a description for the users. Upload a logo or keep a color (keep all other settings default), then click on Save application and on the next screen click Configure Application

2️⃣ Configure the JumpCloud SAML Settings

Go into Brainframe Workspace Settings > Authentication, and enable the In the SSO login to receive the different SAML settings

Inside the newly created JumpCloud SSO Application, select the SSO tab, and copy the "SP Entity ID" and "Default ACL URL" from the Brainframe setting
Make sure to configure "Assertion" as sign method
Now configure in Jumpcloud the firstname and lastname User attributes, as well as the Constant attribute "WorkspaceId" (note that this is case sensitive). You find the valid Workspace ID inside Brainframe
On JumpCloud, click SAVE to finalize the SSO settings.

3️⃣ Brainframe Configuration

Once JumpCloud is ready, we'll finalize the Brainframe GRC side in Workspace Settings → Authentication.

Copy the "IdP URL" from JumpCloud to the Brainframe SSO "IdP Single sign on (SSO) Login URL"
Download the Certificate of the application (Open the certificate and copy everything WITHOUT the BEGIN/END CERTIFICATE lines) → Paste into IdP application certificate in Brainframe.
Now click SAVE inside Brainframe to store and enable SSO for this workspace.

When a user enters their email during login, they will now see the SSO login button for your workspace. You can optionally check that users are automatically redirected to the IdP SSO page after the email was entered (only works if this email is linked to a single workspace with SSO enabled)

4️⃣ Assign groups & test

Check the groups that should get access in the JumpCloud application and click SAVE.

Now you can test the application via JumpCloud SSO page

A brand-new user who signs in with their company SSO gets a Brainframe account, and that account is immediately active. Password login is turned off for them.

⚠️ SSO must be enabled for the workspace. If it is not, the SAML callback stops before any account is created.

When the email presented by SAML is unknown in the system, Brainframe provisions the user in that workspace:

It creates the identity.
It adds a user with that identity to the workspace, using the SAML name and email, with the status active.
It sets the user as a non-admin.
It marks the user as created from the identity provider and disables password login, so the user cannot log in outside of SSO after being deactivated in the IdP.

Disabling a user

An admin can later disable the account in Brainframe. A later SSO login is then rejected with the message:

"Your account has been disabled in this workspace."

6️⃣ Common Errors & Fixes

❌ Failed to read asymmetric key: you should update the “IdP application certificate “in Brainframe GRC settings with the IdP BASE64 certificate (without the BEGIN/END Certificate line)

❌ Attributes mismatch → All attributes are case sensitive (e.g WorkspaceId must be exact).

❌ No account is created on first SSO login → SSO is not enabled for the workspace. Enable it in Workspace Settings → Authentication and save.

❌ "Your account has been disabled in this workspace." → An admin disabled this user in Brainframe. Re-enable the account in the workspace user settings.

Updated on: 15/10/2026

Was this article helpful?

Thank you!