Configuring Authentication

The JAMS Web Client supports multiple options for authentication to allow users to sign in to the application. You can configure the following options:

Identity Providers with OpenID Connect (OIDC) or SAML 2.0, such as Microsoft Entra ID.
User Federations with Active Directory LDAP or local Windows accounts.

Identity Providers, User Federations, and JAMS Credentials

Identity Providers and User Federations both let you configure how your users log in to the JAMS Web Client. There is no interaction between the Identity Provider and User Federations, and they are managed in different ways.

JAMS Credentials are configured from the Credentials menu, and they are used to run Jobs in JAMS or store connection information to third-party applications. Every Job must have a Credential assigned to it in the Execute As property.

There are some key differences to note as listed below.

Identity Providers

The user accounts are not managed and authenticated in the JAMS Web Client.
No synchronization within the JAMS Web Client is required.
If you enable your Identity Provider configuration to make it active, you must restart the JAMS Identity service in the Windows Services manager for the changes to take effect. A message is displayed prompting you to restart the JAMS Identity service when you enable an Identity Provider.
You can have one OIDC and one SAML2 Identity Provider enabled at one time in the JAMS Web Client. Additional Identity Providers can be saved and configured, but they must be disabled.
A button for the enabled Identity Provider is displayed on the JAMS Web Client Log in screen under the or continue with label. You can set the text for this button when you configure the Identity Provider. When users click the button, they are either redirected to the identity provider site for authentication for the initial sign in or they are automatically signed in.

User Federations

The user accounts are managed and authenticated by the JAMS Web Client.
Synchronization within the JAMS Web Client is required when changes are made to accounts. Federation synchronization will affect systems outside of JAMS. Contact your Active Directory Administrator prior to enabling or adjusting these values.
When working with User Federations, you should have the Configuration ACL access.
The Username and Password fields on the JAMS Web Client Log in screen are used for the Active Directory LDAP or local Windows accounts.

JAMS Credentials

These accounts are managed and authenticated by the JAMS Web Client.
These Credentials are separate from the user accounts in a User Federation or Identity Provider.
These are accounts that are used to control who can run Jobs by assigning it to the Execute As field in the Job or Folder properties.

Configuring Access

Within JAMS, you can set permission levels for the Identity Provider user accounts. This allows you to set what features and functionality they have access to. You can set the access levels on items like Agents, Credentials, and Jobs. The Authenticated Users group should be added to any JAMS option that you want single sign-on users to access. You should add the Authenticated Users group under the corresponding ACL and assign the necessary access to that group.