Skip to main content

Configure SingleStore SSO using JumpCloud

Overview

These instructions describe how to configure single sign-on (SSO) for use with JumpCloud SingleStoreDB Cloud. To log into SingleStore, go to http://portal.singlestore.com.

Note: You may click on the image to display its full size.

Configure JumpCloud

  1. Log in to the JumpCloud admin account.

    jc01.png

  2. Click SSO on the left.

    jc02.png

  3. Fill in the General Info:

    1. Display name: SingleStore Cloud

    2. Description: Our primary database

  4. Click on Custom SAML App

    jc02a.png

    1. Download the SingleStore logo, which must be less than 100KB.

    2. Click Logo

    3. Click Replace Logo and add the SingleStore logo.

  5. Click the SSO option on the top row situated next to General Info

    jc05.png

  6. Upload Metadata

    1. Select and copy the following XML, edit it, by changing the YOUR-DOMAIN-NAME to your actual fully-qualified domain name and then upload it.

      <md:EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://keycloak-prod.internal.memcompute.com/auth/realms/memsql" ID="ID_058b2172-4fb9-467c-a0b2-e602621202aa"><md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true"><md:KeyDescriptor use="signing"><ds:KeyInfo><ds:KeyName>jAJ1Baa7zIHaUFcQVNwdudBZ_Hf7otmPAST_W3lpv7c</ds:KeyName><ds:X509Data><ds:X509Certificate>MIICmzCCAYMCBgFlkRngfjANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZNZW1TUUwwHhcNMTgwODMxMTc0NjU2WhcNMjgwODMxMTc0ODM2WjARMQ8wDQYDVQQDDAZNZW1TUUwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPi6mTaWOijeYPngHcj4R0ZH83nA8CfF9olTKWXLfzjN/Chno1NXRyD8/ZMMVxQSbfJgphTZ3n9aFgxRwohl110eOxJGE93On2gRRm5Z8uhjLBWFuOj+HrY2EyKVeiUwdEqaVPw3usIywy7kokJb5EDrPFczgfB0exDD65MrCR36G4EDIkuI8lyCMaEgkkRXDJdufPPHtyTq4dfsjZ2EqHij4luEecTeHybdyUMOzVs3TUHDJsVZhMTEsPquIUQNU4yIAmyT1HpZ/DtgH5KJ6WLm5cUaQHTaN8X6ST3hnMvVuvNLUW73oZekQ7ua1V03oihk0YoAvZ7b/ABpBZz2gpAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAEQkjLX15+H4ORz+jblCZHAwzWy60sGShIDWAGoVGS5VvvrXVo2+IhhElgVwvZDXhg9faUItIvEDO2ptcvEJqLwy/xfqxS0DNx/5cntiw88zlk3NkR0cjUubLJ7ff9AQUcMQNrB9n6uiayRIt8fc+crmTR5j+7uBAWquArW5ZLK7eE2wFAyNA0qSidD8VzjpFU4WMDRCyQwNpuZEBSAaQ3UfKUSC+zbroHyGC9QPEsGNTnUnY/eZ2lVK8ZaARmpccsBT8C7Mqt3t35igzlWsfIR+/dzDKGurFk/krchQ3U2aL5DX6T+8ZDtvPK67yBGyllQccMfWAIabQSwyKsPXazU=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://auth.singlestore.com/auth/realms/memsql/broker/YOUR-DOMAIN-NAME/endpoint"></md:SingleLogoutService><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://auth.singlestore.com/auth/realms/memsql/broker/YOUR-DOMAIN-NAME/endpoint" isDefault="true" index="1"></md:AssertionConsumerService><md:AttributeConsumingService isDefault="true" index="1"><md:ServiceName xml:lang="en">MemSQL</md:ServiceName><md:RequestedAttribute Name="firstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute><md:RequestedAttribute Name="lastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute><md:RequestedAttribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute></md:AttributeConsumingService></md:SPSSODescriptor></md:EntityDescriptor>

    2. Fill in the ACS URL as follows:

      https://auth.singlestore.com/auth/realms/memsql/broker/YOUR-DOMAIN-NAME/endpoint

      (replace YOUR-DOMAIN-NAME with your fully-qualified domain name in the URL)

    3. Take a screenshot of the above.

    4. Fill in the IdP URL

      This cannot be adjusted later. You can only change the last bit.  Do not put “SingleStore” because this namespace is shared with other JumpCloud customers.  Instead, put your fully-qualified domain name but use the dash (-) instead of a period (.)

    5. Fill in the SP Entity ID as follows:

      https://auth.singlestore.com/auth/realms/memsql

    6. Fill in the USER ATTRIBUTE MAPPING.

      jc11.png

    7. Take a screenshot showing both the attributes and the IdP URL.

    8. Click activate

    9. Now, under SSO/Configured Applications, you should see SingleStore. Click it.

      jc14.png

    10. Now click Export Metadata

      jc15.png

  7. Share the metadata and your two screenshots with SingleStore in a support ticket to turn on the SSO.

  8. Go to User Groups in the SingleStore SSO config and configure which users can access SingleStore. Users have to be invited into your SingleStore org on the SingleStore side, so you can configure all your users at one time.

    jc13.png
In this section: