Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide walks you through configuring JumpCloud as the primary Identity Provider (IdP) for ngrok endpoints using single sign-on (SSO). By integrating JumpCloud SSO with ngrok, you can:
  • Restrict access to ngrok endpoints only to users authenticated via JumpCloud
  • Use JumpCloud security policies and multi-factor authentication (MFA) authenticators
  • Use JumpCloud’s Dashboard to facilitate access to ngrok apps

​
What you’ll need

  • A JumpCloud account with administrative rights to create apps.
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with SAML.

​
1. Create a custom SAML application in JumpCloud

Create a custom SAML application and export its IdP metadata by following JumpCloud’s guide, SSO using Custom SAML Application Connectors. Name the application ngrok saml. ngrok generates the service provider (SP) Entity ID and Assertion Consumer Service (ACS) URL from your endpoint URL, which you don’t have yet, so enter temporary values (such as https://temporary) for the SP Entity ID and ACS URL for now. You replace them with the ngrok-generated values in step 3. Export the metadata XML from JumpCloud. You use it in the next step.

​
2. Configure ngrok

The SAML Traffic Policy action is currently in developer preview. Request access to configure SAML via Traffic Policy.
Once you have developer preview access, create a policy.yaml file with the following content, replacing YOUR_IDP_METADATA_XML with the IdP metadata XML from JumpCloud:
The SAML action generates your ngrok SP Entity ID and ACS URL based on your endpoint URL. Refer to the SAML action documentation for how to retrieve your SP metadata XML, which you upload to JumpCloud in the next step. Back in JumpCloud, open your custom SAML application and upload the ngrok SP metadata XML you retrieved in the previous step. This replaces the temporary values with the ngrok-generated SP Entity ID and ACS URL. Save the application.

​
4. Start an endpoint

This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok agent installed.
Run the following command, replacing 3000 with your local web app port and YOUR_DOMAIN with your ngrok domain:
Copy the URL next to Forwarding. You use this URL to test the JumpCloud authentication.

​
5. Grant access to JumpCloud users

JumpCloud restricts access to SSO apps through user group assignments. By default, apps created in JumpCloud have no group assignments, so nobody can use JumpCloud SSO to access ngrok until you assign a group to the app. Open your ngrok custom SAML app, assign the group whose members need access under the User Groups tab, and save. Add JumpCloud users to that group whenever they need access to the ngrok app.

​
6. Test the integration

  • In your browser, launch an incognito window.
  • Access your ngrok endpoint (for example, https://jumpcloud-sso-test.ngrok.app or using the copied endpoint URL).
  • When prompted, log in with your JumpCloud credentials.
  • After you log in, you see your web app.