JumpCloud (SAML)

import { Render } from "~/components";

JumpCloud provides SSO identity management. Cloudflare Access integrates with JumpCloud as a SAML identity provider.

The following steps are specific to setting up JumpCloud with Cloudflare Access. For more information on configuring JumpCloud SSO application, refer to the JumpCloud documentation.

Set up Jumpcloud as a SAML provider

1. Create an SSO application in JumpCloud

1. In the JumpCloud Admin Portal, go to SSO Applications.

2. Select Add New Application.

3. In the search bar, enter Cloudflare and select the Cloudflare Access application.

4. Select Next.

5. In Display Label, enter an application name.

6. Select Save Application.

7. Review the application summary and select Configure Application.

8. In the SSO tab, configure the following settings:

   1. In IdP Entity ID, enter your Cloudflare team domain:

      https://<your-team-name>.cloudflareaccess.com/
      

   2. Set both SP Entity ID and ACS URL to the following callback URL:

      https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback
      

   3. (Optional) Configure SAML attributes that you want to send to Cloudflare Access.

   4. Scroll up to JumpCloud Metadata and select Export Metadata. Save this XML file for use in a later step.

9. In the User Groups tab, assign user groups to this application.

10. Select Save.

2. Add JumpCloud to Cloudflare One

1. In the Cloudflare dashboard, go to Zero Trust > Integrations > Identity providers.

2. Under Your identity providers, select Add new identity provider.

3. Select SAML.

4. Upload your JumpCloud XML metadata file.

5. (Optional) To enable SCIM, refer to Synchronize users and groups.

6. (Optional) Under Optional configurations, configure additional SAML options.

7. Select Save.

You can now test your connection and create Access policies based on the configured login method and SAML attributes.

Synchronize users and groups

The JumpCloud integration allows you to synchronize user groups and automatically deprovision users using SCIM.

1. Enable SCIM in Cloudflare One

<Render file="access/enable-scim-on-dashboard" product="cloudflare-one" params={{ idp: "JumpCloud" }} />

2. Configure SCIM in JumpCloud

1. In the JumpCloud Admin Portal, go to SSO Applications.
2. Select the Cloudflare application that was created when you Set up JumpCloud as a SAML provider.
3. Select the SSO tab.
4. To provision user groups, select Include group attribute and enter groups. The group attribute name has to exactly match groups or else it will be sent as a SAML attribute.
5. Select the Identity Management tab.
6. Make sure that Enable management of User Groups and Group Membership in this application is turned on.
7. Select Configure.
8. In the Base URL field, enter the SCIM Endpoint obtained from Cloudflare One.
9. In the Token Key field, enter the SCIM Secret obtained from Cloudflare One.
10. Select Activate. You will receive a confirmation that the Identity Management integration has been successfully verified.
11. Select Save.

Provisioning attributes

Provisioning attributes define the user and group properties that JumpCloud will synchronize with Cloudflare Access. By default, JumpCloud will send the following attributes during a SCIM update event:

Example API configuration

{
	"config": {
		"issuer_url": "jumpcloud",
		"sso_target_url": "https://sso.myexample.jumpcloud.com/saml2/cloudflareaccess",
		"attributes": ["email", "name", "username"],
		"email_attribute_name": "",
		"sign_request": false,
		"idp_public_cert": "MIIDpDCCAoygAwIBAgIGAV2ka+55MA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG\nA1UEC.....GF/Q2/MHadws97cZg\nuTnQyuOqPuHbnN83d/2l1NSYKCbHt24o"
	},
	"type": "saml",
	"name": "jumpcloud saml example"
}