Integrate OAuth2 authentication

Enterprise

Navigate to System settings > Authentication > OAuth2.

In the OAuth2 field, check to enable OAuth2 authentication.

In the Service provider field, type the OAuth2 service provider name, such as GitHub, Google, Facebook, etc.

In the Logo field, upload the OAuth2 service provider logo, recommended to use a size of 64px * 64px.

The Service provider and logo will be displayed on the login page.

In the Client ID field, type the client ID provided by the OAuth2 service provider.

In the Client secret field, type the client secret provided by the OAuth2 service provider.

In the Request method field, select a method to obtain a token.

In the Scope field, defines the range of user information that the client requests access to in an authorization request. Multiple pieces of information are separated by spaces, such as "user user:email user:login".

In the Authorization endpoint field, type the OAuth2 authorization endpoint, such as "https://​github.com/login/oauth/authorize".

In the Token endpoint field, type the OAuth2 token endpoint, such as "https://​github.com/login/oauth/access_token".

In the Userinfo endpoint field, type the OAuth2 userinfo endpoint, such as "https://​api.github.com/user".

In the End session endpoint field, type the OAuth2 end session endpoint, such as "https://​github.com/logout", when the user logs out, this endpoint will be called.

In the User attribute field, type the user attribute mapping. The key represents the JumpServer user attribute name (available options: name, username, email, groups, phone, comment), while the value corresponds to the OAuth2 user attribute name.

{
  "name": "user",
  "username": "name",
  "email": "user:email"
}

In the Organization field, after authentication and creation, the user will be added to the selected organization.

In the Always update user field, when checked, after OAuth2 user authentication, user information (only includes: name, username, email, phone, comment) will be updated each time, "groups" are only synchronized when the user is created.

In the Logout completely field, when checked, the user will be logged out from the OAuth2 service by calling the "End session endpoint" upon logging out.

Click Submit.