Skip to content

Change identity providers and renew SSO certificates#

To switch identity providers (IdPs) or renew an IdP signing certificate, upload new IdP metadata. Upload new metadata when your organization moves to a new IdP, or before your IdP's signing certificate expires, so that members can continue to sign in with SSO. For first-time setup, see Set up single sign-on.

Applies to#

  • Jump Desktop for Teams Enterprise plan.
  • Team administrators.

Before you start#

Ensure that you can still sign in if the new metadata does not work.

  1. In the Teams dashboard, open your team and click Security.
  2. In Team Single Sign On, clear Require SSO for 'team name' team and click Don't Require SSO. While SSO is required, members who have linked SSO cannot sign in with a password.
  3. If a verified domain has Require SSO Login turned on, turn it off. See Verify your domain.
  4. In the sidebar, click Security (your account's page, not the team's). If Set Your Password appears, set a password. (Change Your Password indicates that your account already has a password.)
  5. If your account uses two-factor authentication, keep your authenticator app or backup codes available.
  6. Save a copy of your current IdP metadata XML file.

Upload the new metadata#

  1. In your IdP, do one of the following:
    • New provider: create a SAML app using the ACS URL and Entity ID from Manage SAML SSO. These values do not change when you switch providers. Keep the old IdP app until testing succeeds. For per-provider steps, see Set up single sign-on.
    • Expiring certificate: add the new signing certificate, and activate it before the old one expires.
  2. Download the IdP metadata XML file.
  3. On your team's Security page, click Manage SAML SSO.
  4. Click Upload IDP Metadata and choose the XML file. The message SAML IDP metadata updated appears.

Keep this browser window signed in until you have tested the change.

Members retain their Jump Desktop accounts. Before members rely on the new provider, confirm that someone who already signed in with the old provider can sign in with the new one (see Test the change). If that person cannot sign in, contact Jump Desktop support.

Renew a certificate without downtime#

Jump Desktop accepts any signing certificate listed in the uploaded metadata and rejects expired certificates. If your IdP can publish metadata containing both the old and new certificates, upload that metadata before you switch the IdP to the new certificate and before the old certificate expires.

Test the change#

  1. Open a private (incognito) browser window and go to app.jumpdesktop.com.
  2. Click Sign in with SSO, enter your company name or email, and sign in through your IdP.
  3. New provider: repeat the test with another member who signed in with SSO before the switch. Complete this test before you require SSO again.

If sign-in fails, revert the change in the original browser window. If you were signed out, sign in with your email address and password.

  • New provider: upload the metadata file you saved.
  • Certificate renewal: switch your IdP back to the old certificate and upload the saved metadata, or fix the new metadata and upload it again. Re-uploading the old metadata alone does not resolve the failure.

Finish#

After your members have signed in successfully, select Require SSO for 'team name' team again and re-enable Require SSO Login on any domain where you turned it off.