If you’re interested in using SCIM, the following articles show you how to configure and connect SCIM applications to JumpCloud:<\/p>\n\n\n\n
- \n
- Get Started: SCIM Identity Management<\/a><\/li>\n\n\n\n
- IdM using a Custom SCIM Integration<\/a><\/li>\n<\/ul>\n\n\n\n
Application Challenges <\/strong><\/h2>\n\n\n\n
Organizations have shifted from having a handful of applications hosted on a local server to using thousands of web-based applications to get work done. This shift has introduced many benefits, like greater agility and faster times to market. However, web-based applications have also surfaced a number of challenges related to identity management; credential overload for end users, decreased security, and reduced efficiency for end users and IT admins. <\/p>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nBoth OIDC and SAML SSO are supported. JIT provisioning is only available on SAML apps.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
The Value in SSO and JIT Provisioning<\/strong><\/h2>\n\n\n\n
SSO<\/strong><\/h3>\n\n\n\n
SSO provides end users with a single set of credentials to access all of their applications. This helps users avoid lock-out delays due to forgetting their password because they only have to remember one. End users also don\u2019t have to enter 50 different credentials to access all of their tools. Instead, users log in to their JumpCloud User Portal, and from there can access their applications with just a click, reducing hassle and allowing more time to focus on work. <\/p>\n\n\n\n
Using JumpCloud\u2019s SSO feature helps IT admins to create one place to manage user access to all of the applications in the admin\u2019s environment. This lets admins increase security by centrally enforcing security policies, and enables them to take care of sensitive matters, like compromised credentials, quickly. <\/p>\n\n\n\n
JIT Provisioning<\/strong><\/h3>\n\n\n\n
JIT provisioning automates many of the IT processes related to provisioning users to applications. Without this feature, IT admins have to create a new user in the identity provider and create an account for that user in each application to which they need access. JIT provisioning eliminates this busywork by creating a new user account in an application the first time a user logs in to the application using SSO. <\/p>\n\n\n\n
Connecting SSO Applications to JumpCloud<\/strong><\/h2>\n\n\n\n
To gather information from the Service Provider<\/strong><\/h3>\n\n\n\n
- \n
- Find out if metadata is available from the service provider (SP). If metadata is available, download it so that you can use it to configure the connector in JumpCloud.<\/li>\n\n\n\n
- If the SP requires it, enable SAML functionality.<\/li>\n\n\n\n
- Keep the SP information handy when you start configuring the SSO connector in JumpCloud.<\/li>\n<\/ol>\n\n\n\n
To configure the connector In JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- If a metadata file is available from the SP, start by uploading it to JumpCloud. This will populate SAML connector attributes for that application. If a metadata file isn\u2019t available, use a prebuilt connector, if available, or manually enter the SAML connector attributes. In this case, refer to the SP\u2019s SSO configuration section to retrieve the information you need. <\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
When you upload a metadata file, the fields don’t populate right away. You need to save the connector, then open it again to see the SAML connector fields populated.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- After the attributes are entered, activate the connector in JumpCloud. This automatically creates an identity provider certificate and private key pair. <\/li>\n\n\n\n
- Export the metadata from JumpCloud. To export JumpCloud metadata, navigate to User Authentication > SSO<\/strong>: \n
- \n
- From the Configured Applications<\/strong> list – scroll to or search for the application. Select the checkbox next to the application and then click Export Metadata<\/strong> in the top right corner. <\/li>\n\n\n\n
- In the application\u2019s Details Panel<\/strong> – select the SSO <\/strong>tab and then click Export Metadata<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n\n\n
To Configure the Connector in the Service Provider<\/strong><\/h3>\n\n\n\n
- \n
- Upload JumpCloud\u2019s metadata file to the SP. This populates the SAML attributes in the SP. <\/li>\n\n\n\n
- Save the SP configuration settings. <\/li>\n<\/ol>\n\n\n\n
JIT Provisioning and Authorization<\/strong><\/h2>\n\n\n\n
User Provisioning and Authorization without JIT<\/strong><\/h3>\n\n\n\n
- \n
- Create user accounts in JumpCloud, then create them in the SP. <\/li>\n\n\n\n
- Assign the JumpCloud users to a user group. <\/li>\n\n\n\n
- Authorize the user group\u2019s access to the application.<\/li>\n<\/ol>\n\n\n\n
User Provisioning and Authorization with JIT <\/strong><\/h3>\n\n\n\n
- \n
- Enable JIT provisioning in the SP.<\/li>\n\n\n\n
- Ensure the right attributes are configured in JumpCloud.<\/li>\n\n\n\n
- Create user accounts in JumpCloud.<\/li>\n\n\n\n
- Assign the users to a user group, then authorize access to the application. <\/li>\n\n\n\n
- Users are provisioned to the application the first time they log in to the application using SSO. <\/li>\n<\/ol>\n\n\n\n
The value in SCIM<\/strong><\/h2>\n\n\n\n
Using SCIM, you can streamline user access to web applications, making onboarding and offboarding users more efficient. Since JumpCloud is entirely cloud based, you can manage your users\u2019 application identities from a single location. <\/p>\n\n\n\n
The following actions are supported with JumpCloud IdM Connectors:<\/p>\n\n\n\n
- \n
- Provisioning – a new account is created for the user in the connected application with your specified attributes.<\/li>\n\n\n\n
- Updating – anytime you update the user in JumpCloud, the user is also updated in the application.<\/li>\n\n\n\n
- Deprovisioning – after unbinding a user from the application in JumpCloud, the user is deactivated in the application.<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
Not all applications support all three IdM actions.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Connecting IdM Applications to JumpCloud<\/strong><\/strong><\/h2>\n\n\n\n
Applications that you can integrate with JumpCloud through an IdM Connector can be found on the Configure New Applications panel with the IdM<\/strong> badge displayed. <\/p>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/06\/SSO-Applications-left-nav-Applications-window.jpg\")
<\/figure>\n\n\n\n
- In the application\u2019s Details Panel<\/strong> – select the SSO <\/strong>tab and then click Export Metadata<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n\n\n
- From the Configured Applications<\/strong> list – scroll to or search for the application. Select the checkbox next to the application and then click Export Metadata<\/strong> in the top right corner. <\/li>\n\n\n\n
- If a metadata file is available from the SP, start by uploading it to JumpCloud. This will populate SAML connector attributes for that application. If a metadata file isn\u2019t available, use a prebuilt connector, if available, or manually enter the SAML connector attributes. In this case, refer to the SP\u2019s SSO configuration section to retrieve the information you need. <\/li>\n<\/ol>\n\n\n\n
- IdM using a Custom SCIM Integration<\/a><\/li>\n<\/ul>\n\n\n\n