---
title: 'Tutorial: Authenticate Using SAML with JumpCloud'
canonical: https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-jumpcloud/
product: CloudConnexa Docs
description: Configure JumpCloud as a SAML identity provider for CloudConnexa using the SAML Setup Wizard — covers uploading the SP metadata file, configuring the JumpCloud SSO application, mapping attributes including memberOf for groups, testing the connection, and optional SCIM provisioning.
---

# Tutorial: Authenticate Using SAML with JumpCloud

## Overview

Configure JumpCloud as a SAML 2.0 identity provider (IdP) for CloudConnexa using the SAML Setup Wizard. This lets your users authenticate to CloudConnexa with their JumpCloud credentials.

You'll create a custom SAML app in JumpCloud, exchange configuration details between JumpCloud and CloudConnexa, map user attributes, and test authentication before completing the setup.

## Before you begin

You need:

- **CloudConnexa:** The Owner or Administrator role for the WPC you're configuring.
- **JumpCloud:** An administrator account with the SSO Package or higher, or the SSO à la carte option. The base package doesn't include SSO.
- **Access to both administration portals:** Keep both open while you configure SAML because you'll exchange values between them.

> **Note**
>
> If you manage multiple WPCs, ensure you're configuring the correct Cloud ID. Each WPC has its own SAML authentication configuration.

## Step 1: Start the SAML Setup Wizard

Start by selecting JumpCloud as your IdP in CloudConnexa.

1. Sign in to your WPC's Administration portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings → User Authentication**.
3. Select **Edit**.
4. On the **SAML Single Sign-On** card, select **Setup**.
5. Under **Select Your Identity Provider**, select **JumpCloud**.
   - The wizard displays the configuration instructions and default attribute mappings for JumpCloud.

   > **Tip**
   >
   > If you selected the wrong provider, select **Change** next to **Your Identity Provider** on the next screen.

## Step 2: Get the service provider values for CloudConnexa

JumpCloud needs service provider (SP) values from CloudConnexa to send SAML authentication responses to the correct WPC.

1. Under **Share CloudConnexa Metadata**, select **Download**.
   - The metadata file (.xml) downloads to your machine.

     > **Tip**
     >
     > We recommend using the XML file for configuring the JumpCloud app to avoid manual entry errors.
2. Or, you can copy the following values:

   | **CloudConnexa value** | **Use in JumpCloud** | **Format** |
   | --- | --- | --- |
   | Single Sign-On URL (ACS) | ACS URL | `https://sso-backend.openvpn.com/sso/api/v1/saml/acs` |
   | Issuer Name | SP Entity ID | `<cloud-id>.openvpn.com` |

   > **Tip**
   >
   > The ACS URL is the same for every CloudConnexa WPC.
   >
   > For the Issuer Name, the `<cloud-id>` is replaced with your WPC's Cloud ID prefix.
3. Keep the wizard open. You'll return to it after configuring JumpCloud.

For more information, refer to [SAML and SCIM Service Provider Endpoints for CloudConnexa](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa.md).

## Step 3: Create a SAML SSO application in JumpCloud

Create an SSO application in JumpCloud to connect JumpCloud to CloudConnexa.

1. Sign in to the [JumpCloud Admin Portal](https://console.jumpcloud.com/).
2. Navigate to **Access → SSO Applications**.
3. Select **+ Add New Application**.
4. Search for `CloudConnexa`.
5. If a CloudConnexa connector isn't available:
   - Select **Create A Custom Integration**.
   - Select **Next**.
   - Select **Manage Single Sign-On (SSO)**.
   - Select **Configure SSO with SAML**.
   - Select **Next** and step through the remainder of the creation steps.
6. Open the application's **SSO** tab.

### Configure the service provider details

Use the metadata XML file downloaded from CloudConnexa to configure the service provider values.

1. On the **SSO** tab, upload the CloudConnexa service provider metadata XML file from Step 2.
2. Verify that the application uses the correct values:

   | **JumpCloud field** | **Value** |
   | --- | --- |
   | SP Entity ID | **Issuer Name** from Step 2 |
   | ACS URL | **Single Sign-On URL (ACS)** from Step 2 |
3. Review the **IdP URL** before saving the application.

   > **Tip**
   >
   > The URL uses a format similar to: `https://sso.jumpcloud.com/saml2/<value>`

   > **Important**
   >
   > You can't change the **IdP URL** after the application is created. Verify its value before saving. If you need to change it later, you'll need to recreate the application.

### Configure user attributes

JumpCloud sends user information through SAML attributes. Configure the service provider attribute names that CloudConnexa expects.

1. On the **SSO** tab, locate **User Attributes**.
2. Select **Add Attribute** to start adding attributes.
3. Configure the following **Service Provider Attribute Names**:

   | **Service Provider Attribute Name** | **JumpCloud Attribute Name** |
   | --- | --- |
   | Email Address | `email` |
   | Username | `username` |
   | First Name | `firstname` |
   | Last Name | `lastname` |
4. Verify that each attribute name matches the table exactly, including capitalization.

   > **Important**
   >
   > The **Service Provider Attribute Name** determines the attribute name sent to CloudConnexa. The **JumpCloud Attribute Name** determines which user profile value JumpCloud sends.

### Optional: Include JumpCloud group membership

If you want CloudConnexa to assign users to user groups based on their JumpCloud group membership, configure JumpCloud to include group information in SAML assertions.

1. On the application's **SSO** tab, enable **Include Group Attribute**.
2. In **Group Attribute Name**, enter `memberOf`.

   > **Important**
   >
   > If **Include Group Attribute** is enabled, **Groups Attribute Name** can't be blank. Enter `memberOf` or disable the option.
   >
   > The `memberOf` attribute contains the group information used by CloudConnexa user group mapping rules. Sending this attribute doesn't automatically assign CloudConnexa user groups.

### Save the SSO application

1. Save the SAML application configuration in JumpCloud.
2. Return to **Access → SSO Applications**.
3. Verify that the application displays a green check under **Status**.

### Bind user groups to the application

JumpCloud controls access to SSO applications through user group bindings.

1. Open the application.
2. Select the **User Groups** tab.
3. Select the JumpCloud user groups that need access to CloudConnexa.
4. Select **Save**.

   > **Important**
   >
   > JumpCloud denies access to the SSO application until a user group is bound to it. Creating the application and configuring SAML attributes isn't enough to grant users access.

### Retrieve the JumpCloud metadata URL

1. Select the application's **SSO** tab.
2. Select **Copy Metadata URL**.
3. Save the URL for use in the CloudConnexa SAML Setup Wizard.

Alternatively, select **Export Metadata** to download the JumpCloud identity provider metadata XML file.

## Step 4: Connect JumpCloud to CloudConnexa

Now provide the JumpCloud SAML configuration to CloudConnexa.

1. Return to the SAML Setup Wizard in CloudConnexa.
2. Select **Next Step**.
   - **Provide JumpCloud Details** is displayed.
3. Paste the JumpCloud metadata URL into **IdP Federation Metadata URL**.

   > **Note**
   >
   > If you exported the JumpCloud metadata XML file instead, use the **Metadata XML** method in the wizard to import it. When the JumpCloud signing certificate changes, ensure the CloudConnexa configuration uses the updated metadata.

   - Alternatively, you can upload the metadata XML file if you downloaded it from JumpCloud.
4. Wait for CloudConnexa to retrieve the metadata.
5. Verify that the wizard displays **Metadata retrieved**, along with the issuer and signing certificate expiration date.
6. Leave **Advanced Settings** at their defaults.
7. Select **Next Step**.

## Step 5: Map user attributes

CloudConnexa uses SAML attributes to identify users and retrieve their information from JumpCloud.

The **Map User Attributes** step displays after you select **Next Step**. The wizard provides default JumpCloud mappings.

1. Enable **Allow user attributes mapping (Optional)**.
2. Review the default mappings for JumpCloud.

   | **CloudConnexa field** | **JumpCloud attribute name** |
   | --- | --- |
   | Email Address | `email` |
   | Username | `username` |
   | Group | `memberOf` |
   | First Name | `firstname` |
   | Last Name | `lastname` |
3. If the default values match what your JumpCloud application sends, leave them unchanged.
4. If your application sends different attributes, update the corresponding fields. Ensure each mapping matches, including capitalization.
5. Select **Next Step**.

## Step 6: Test SAML authentication

Test the connection before completing the configuration to confirm that CloudConnexa can authenticate users through JumpCloud.

1. In the wizard, the **Test JumpCloud Connection** step displays.
2. Select **Sign in With SAML SSO**.
3. Authenticate using a JumpCloud account that has access to the custom SAML app.
4. Review the test results. CloudConnexa checks the SAML response for:
   - A response received at the ACS endpoint.
   - A valid signature.
   - An issuer that matches the configuration.
   - An audience that matches the SP Entity ID.
   - An assertion timestamp within the allowed clock skew.
5. The wizard shows whether each check passed or failed.

### Verify the user attributes

1. The test also displays the user information received from JumpCloud:
   - Email
   - First Name
   - Last Name
   - IdP Group
   - Username
2. If a field displays `-`, CloudConnexa didn't receive a value under the expected attribute name. Compare the attribute statements in JumpCloud with the mappings from Step 5.

   > **Tip**
   >
   > Test with an account that belongs to a JumpCloud group you plan to map. This lets you verify that JumpCloud sends the expected `memberOf` values.

   > **Note**
   >
   > A successful test confirms authentication for the account you used. It doesn't verify every user in your JumpCloud directory.

### If the test fails

1. Review the check.
2. Correct the configuration.
3. Select **Run Test Again**.
   - Although the wizard allows you to continue after a failed test, we recommend resolving the errors before completing setup. Otherwise, users may be unable to authenticate.

## Step 7: Review and complete the configuration

The **Configuration Details** step summarizes the SAML settings you've configured.

1. Review the following information:

   | **Setting** | **What to verify** |
   | --- | --- |
   | Metadata Source | How CloudConnexa retrieves the JumpCloud configuration |
   | Attributes Mapped | The number of configured attribute mappings |
   | Issuer | The issuer value received from JumpCloud |
   | Signing Certificate | Certificate validity and expiration date |
2. You can also review the advanced settings, including Data Binding, Authentication Lifetime, Reconnecting, Authentication Context, and Logout URL.
   - The wizard may display additional setup options for user group mapping and SCIM provisioning.
3. Note the signing certificate expiration date.

   > **Important**
   >
   > When JumpCloud's signing certificate changes, authentication fails until CloudConnexa has the new one. If you connected with the metadata URL, supplying it again is enough. If you uploaded the file, export the metadata from JumpCloud again and re-import it. Set a reminder before the expiry date.
4. When you're satisfied with the configuration, select **Complete**.
   - Your SAML configuration is now available for users who have access to the custom SAML app in JumpCloud.

## Optional: Configure user group mapping

If you want CloudConnexa to assign users to user groups based on their IdP group membership, configure SAML user group mapping.

1. In the CloudConnexa Administration portal, navigate to **Settings → User Authentication → SAML Single Sign-On → Configuration → User Group Mapping**.
2. Configure mapping rules for the group information the IdP sends.

For detailed instructions, refer to [Set SAML User Group Mapping Rules](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md).

Group mapping is evaluated when users authenticate. If you change a user's group membership in the IdP, the updated mapping takes effect the next time they authenticate to CloudConnexa.

## Optional: Configure SCIM provisioning

SAML authenticates users when they access CloudConnexa. You can also configure System for Cross-domain Identity Management (SCIM) 2.0 to automate user provisioning.

With SCIM provisioning, the IdP can create, update, and deactivate users in CloudConnexa without waiting for authentication.

1. To configure SCIM, navigate to **Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0**.

   > **Note**
   >
   > SCIM provisions users, not user groups. Group membership still comes from SAML group claims and your user group mapping rules.

## Manage your SAML configuration

After completing the wizard, you can review or change your configuration under **Settings → User Authentication → SAML Single Sign-On → Configuration**.

| **Configuration** | **What you can manage** |
| --- | --- |
| IdP Configuration | JumpCloud metadata, SSO endpoint, issuer, and signing certificate |
| Attribute Mapping | How JumpCloud SAML attributes map to CloudConnexa user fields |
| User Group Mapping | Rules for assigning CloudConnexa user groups |
| SCIM 2.0 | Automatic user provisioning |

## Troubleshooting

Use these checks if authentication fails or CloudConnexa doesn't receive the expected user information.

| Issue | Likely cause | What to check |
| --- | --- | --- |
| The test reports that it didn't receive a response at the ACS endpoint. | JumpCloud sent the response to a different URL, or didn't use HTTP POST. | Verify that the **ACS URL** in JumpCloud matches the **Single Sign-On URL (ACS)** from Step 2. |
| The test reports a signature failure. | The signing certificate configured in CloudConnexa doesn't match the certificate JumpCloud is using. | Refresh the JumpCloud metadata in **IdP Configuration**. |
| The test reports an issuer mismatch. | The Issuer configured in CloudConnexa doesn't match the issuer sent by JumpCloud. | Compare the Issuer shown in Step 7 with the value in the JumpCloud Admin Portal. |
| The test reports an audience mismatch. | JumpCloud has an incorrect **SP Entity ID**. | Verify that **SP Entity ID** matches the **Issuer Name** from Step 2. Uploading the service provider metadata can help avoid manual entry errors. |
| The test reports a timestamp failure. | The assertion has expired or its validity period doesn't match the allowed clock skew. | Retry the test. If it continues to fail, investigate the assertion timestamps and clock synchronization. |
| The user authenticates but has no name or email. | The SAML attributes are missing or use different names from the CloudConnexa mappings. | Compare the **Service Provider Attribute Names** in JumpCloud with the mappings in Step 5. |
| The user isn't assigned to the expected CloudConnexa user group. | The group attribute isn't included in the assertion, or no matching user group mapping rule exists. | Verify that **Include Group Attribute** is enabled and **Groups Attribute Name** is `memberOf`. Then review the user group mapping rules. |
| Authentication worked previously but now fails. | The JumpCloud signing certificate expired or was replaced. | Check the certificate expiration date and refresh the JumpCloud metadata under **IdP Configuration**. |
| The user can't access the SSO application. | The JumpCloud user group isn't bound to the application. | Open the JumpCloud application's **User Groups** tab and bind the appropriate group. |
| The user authenticates in JumpCloud but can't access CloudConnexa. | The user's group isn't bound to the SSO application. JumpCloud denies application access by default. | Open the JumpCloud application's **User Groups** tab and bind the appropriate group. |
| The application won't activate, and saving produces an error. | **Include Group Attribute** is enabled, but **Groups Attribute Name** is blank. | Enter `memberOf` in **Groups Attribute Name** or disable **Include Group Attribute**. |
| An issuer or audience mismatch persists after reviewing the values. | The configured **IdP URL** might be incorrect. | Verify the IdP URL and recheck both metadata sets. If the IdP URL is wrong, recreate the JumpCloud application because you can't change this value after creation. |

## Related resources

- [SAML and SCIM Service Provider Endpoints for CloudConnexa](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa.md)
- [Set SAML Single Sign-On Authentication for Users](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md)
- [Set SAML User Group Mapping Rules](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md)
- [About Multiple Authentication Methods](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/about-multiple-authentication-methods.md)
- [Video: Configure Authentication With SAML and Okta](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--configure-authentication-with-saml-and-okta.md)
- [SAML authentication with CloudConnexa](https://openvpn.net/connect-docs/tutorials/saml-with-cloudconnexa.md)

---

Prev: [Tutorial: Authenticate Using SAML with OneLogin](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-onelogin.md)
Next: [Tutorial: Login to User Portal From SAML Identity Provider](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--login-to-user-portal-from-saml-identity-provider.md)
Index: https://openvpn.net/cloud-docs/llms.txt