Talk with SupportBook a DemoTry for free

Tutorial: Authenticate Using SAML with JumpCloud⁠

Overview⁠

Configure JumpCloud as a SAML 2.0 identity provider (IdP) for CloudConnexa using the SAML Setup Wizard. This lets your users authenticate to CloudConnexa with their JumpCloud credentials.

You'll create a custom SAML app in JumpCloud, exchange configuration details between JumpCloud and CloudConnexa, map user attributes, and test authentication before completing the setup.

Before you begin⁠

You need:

  • CloudConnexa: The Owner or Administrator role for the WPC you're configuring.

  • JumpCloud: An administrator account with the SSO Package or higher, or the SSO à la carte option. The base package doesn't include SSO.

  • Access to both administration portals: Keep both open while you configure SAML because you'll exchange values between them.

Step 1: Start the SAML Setup Wizard⁠

Start by selecting JumpCloud as your IdP in CloudConnexa.

  1. Sign in to your WPC's Administration portal at your Cloud ID address (for example, yourcompany.openvpn.com).

  2. Navigate to Settings → User Authentication.

  3. Select Edit.

  4. On the SAML Single Sign-On card, select Setup.

  5. Under Select Your Identity Provider, select JumpCloud.

    • The wizard displays the configuration instructions and default attribute mappings for JumpCloud.

Step 2: Get the service provider values for CloudConnexa⁠

JumpCloud needs service provider (SP) values from CloudConnexa to send SAML authentication responses to the correct WPC.

  1. Under Share CloudConnexa Metadata, select Download.

    • The metadata file (.xml) downloads to your machine.

  2. Or, you can copy the following values:

    CloudConnexa value

    Use in JumpCloud

    Format

    Single Sign-On URL (ACS)

    ACS URL

    https://sso-backend.openvpn.com/sso/api/v1/saml/acs

    Issuer Name

    SP Entity ID

    <cloud-id>.openvpn.com

  3. Keep the wizard open. You'll return to it after configuring JumpCloud.

For more information, refer to SAML and SCIM Service Provider Endpoints for CloudConnexa.

Step 3: Create a SAML SSO application in JumpCloud⁠

Create an SSO application in JumpCloud to connect JumpCloud to CloudConnexa.

  1. Sign in to the JumpCloud Admin Portal.

  2. Navigate to Access → SSO Applications.

  3. Select + Add New Application.

  4. Search for CloudConnexa.

  5. If a CloudConnexa connector isn't available:

    • Select Create A Custom Integration.

    • Select Next.

    • Select Manage Single Sign-On (SSO).

    • Select Configure SSO with SAML.

    • Select Next and step through the remainder of the creation steps.

  6. Open the application's SSO tab.

Configure the service provider details⁠

Use the metadata XML file downloaded from CloudConnexa to configure the service provider values.

  1. On the SSO tab, upload the CloudConnexa service provider metadata XML file from Step 2.

  2. Verify that the application uses the correct values:

    JumpCloud field

    Value

    SP Entity ID

    Issuer Name from Step 2

    ACS URL

    Single Sign-On URL (ACS) from Step 2

  3. Review the IdP URL before saving the application.

Configure user attributes⁠

JumpCloud sends user information through SAML attributes. Configure the service provider attribute names that CloudConnexa expects.

  1. On the SSO tab, locate User Attributes.

  2. Select Add Attribute to start adding attributes.

  3. Configure the following Service Provider Attribute Names:

    Service Provider Attribute Name

    JumpCloud Attribute Name

    Email Address

    email

    Username

    username

    First Name

    firstname

    Last Name

    lastname

  4. Verify that each attribute name matches the table exactly, including capitalization.

Optional: Include JumpCloud group membership⁠

If you want CloudConnexa to assign users to user groups based on their JumpCloud group membership, configure JumpCloud to include group information in SAML assertions.

  1. On the application's SSO tab, enable Include Group Attribute.

  2. In Group Attribute Name, enter memberOf.

Save the SSO application⁠

  1. Save the SAML application configuration in JumpCloud.

  2. Return to Access → SSO Applications.

  3. Verify that the application displays a green check under Status.

Bind user groups to the application⁠

JumpCloud controls access to SSO applications through user group bindings.

  1. Open the application.

  2. Select the User Groups tab.

  3. Select the JumpCloud user groups that need access to CloudConnexa.

  4. Select Save.

Retrieve the JumpCloud metadata URL⁠

  1. Select the application's SSO tab.

  2. Select Copy Metadata URL.

  3. Save the URL for use in the CloudConnexa SAML Setup Wizard.

Alternatively, select Export Metadata to download the JumpCloud identity provider metadata XML file.

Step 4: Connect JumpCloud to CloudConnexa⁠

Now provide the JumpCloud SAML configuration to CloudConnexa.

  1. Return to the SAML Setup Wizard in CloudConnexa.

  2. Select Next Step.

    • Provide JumpCloud Details is displayed.

  3. Paste the JumpCloud metadata URL into IdP Federation Metadata URL.

    • Alternatively, you can upload the metadata XML file if you downloaded it from JumpCloud.

  4. Wait for CloudConnexa to retrieve the metadata.

  5. Verify that the wizard displays Metadata retrieved, along with the issuer and signing certificate expiration date.

  6. Leave Advanced Settings at their defaults.

  7. Select Next Step.

Step 5: Map user attributes⁠

CloudConnexa uses SAML attributes to identify users and retrieve their information from JumpCloud.

The Map User Attributes step displays after you select Next Step. The wizard provides default JumpCloud mappings.

  1. Enable Allow user attributes mapping (Optional).

  2. Review the default mappings for JumpCloud.

    CloudConnexa field

    JumpCloud attribute name

    Email Address

    email

    Username

    username

    Group

    memberOf

    First Name

    firstname

    Last Name

    lastname

  3. If the default values match what your JumpCloud application sends, leave them unchanged.

  4. If your application sends different attributes, update the corresponding fields. Ensure each mapping matches, including capitalization.

  5. Select Next Step.

Step 6: Test SAML authentication⁠

Test the connection before completing the configuration to confirm that CloudConnexa can authenticate users through JumpCloud.

  1. In the wizard, the Test JumpCloud Connection step displays.

  2. Select Sign in With SAML SSO.

  3. Authenticate using a JumpCloud account that has access to the custom SAML app.

  4. Review the test results. CloudConnexa checks the SAML response for:

    • A response received at the ACS endpoint.

    • A valid signature.

    • An issuer that matches the configuration.

    • An audience that matches the SP Entity ID.

    • An assertion timestamp within the allowed clock skew.

  5. The wizard shows whether each check passed or failed.

Verify the user attributes⁠

  1. The test also displays the user information received from JumpCloud:

    • Email

    • First Name

    • Last Name

    • IdP Group

    • Username

  2. If a field displays -, CloudConnexa didn't receive a value under the expected attribute name. Compare the attribute statements in JumpCloud with the mappings from Step 5.

If the test fails⁠

  1. Review the check.

  2. Correct the configuration.

  3. Select Run Test Again.

    • Although the wizard allows you to continue after a failed test, we recommend resolving the errors before completing setup. Otherwise, users may be unable to authenticate.

Step 7: Review and complete the configuration⁠

The Configuration Details step summarizes the SAML settings you've configured.

  1. Review the following information:

    Setting

    What to verify

    Metadata Source

    How CloudConnexa retrieves the JumpCloud configuration

    Attributes Mapped

    The number of configured attribute mappings

    Issuer

    The issuer value received from JumpCloud

    Signing Certificate

    Certificate validity and expiration date

  2. You can also review the advanced settings, including Data Binding, Authentication Lifetime, Reconnecting, Authentication Context, and Logout URL.

    • The wizard may display additional setup options for user group mapping and SCIM provisioning.

  3. Note the signing certificate expiration date.

  4. When you're satisfied with the configuration, select Complete.

    • Your SAML configuration is now available for users who have access to the custom SAML app in JumpCloud.

Optional: Configure user group mapping⁠

If you want CloudConnexa to assign users to user groups based on their IdP group membership, configure SAML user group mapping.

  1. In the CloudConnexa Administration portal, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → User Group Mapping.

  2. Configure mapping rules for the group information the IdP sends.

For detailed instructions, refer to Set SAML User Group Mapping Rules.

Group mapping is evaluated when users authenticate. If you change a user's group membership in the IdP, the updated mapping takes effect the next time they authenticate to CloudConnexa.

Optional: Configure SCIM provisioning⁠

SAML authenticates users when they access CloudConnexa. You can also configure System for Cross-domain Identity Management (SCIM) 2.0 to automate user provisioning.

With SCIM provisioning, the IdP can create, update, and deactivate users in CloudConnexa without waiting for authentication.

  1. To configure SCIM, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0.

Manage your SAML configuration⁠

After completing the wizard, you can review or change your configuration under Settings → User Authentication → SAML Single Sign-On → Configuration.

Configuration

What you can manage

IdP Configuration

JumpCloud metadata, SSO endpoint, issuer, and signing certificate

Attribute Mapping

How JumpCloud SAML attributes map to CloudConnexa user fields

User Group Mapping

Rules for assigning CloudConnexa user groups

SCIM 2.0

Automatic user provisioning

Troubleshooting⁠

Use these checks if authentication fails or CloudConnexa doesn't receive the expected user information.

Issue

Likely cause

What to check

The test reports that it didn't receive a response at the ACS endpoint.

JumpCloud sent the response to a different URL, or didn't use HTTP POST.

Verify that the ACS URL in JumpCloud matches the Single Sign-On URL (ACS) from Step 2.

The test reports a signature failure.

The signing certificate configured in CloudConnexa doesn't match the certificate JumpCloud is using.

Refresh the JumpCloud metadata in IdP Configuration.

The test reports an issuer mismatch.

The Issuer configured in CloudConnexa doesn't match the issuer sent by JumpCloud.

Compare the Issuer shown in Step 7 with the value in the JumpCloud Admin Portal.

The test reports an audience mismatch.

JumpCloud has an incorrect SP Entity ID.

Verify that SP Entity ID matches the Issuer Name from Step 2. Uploading the service provider metadata can help avoid manual entry errors.

The test reports a timestamp failure.

The assertion has expired or its validity period doesn't match the allowed clock skew.

Retry the test. If it continues to fail, investigate the assertion timestamps and clock synchronization.

The user authenticates but has no name or email.

The SAML attributes are missing or use different names from the CloudConnexa mappings.

Compare the Service Provider Attribute Names in JumpCloud with the mappings in Step 5.

The user isn't assigned to the expected CloudConnexa user group.

The group attribute isn't included in the assertion, or no matching user group mapping rule exists.

Verify that Include Group Attribute is enabled and Groups Attribute Name is memberOf. Then review the user group mapping rules.

Authentication worked previously but now fails.

The JumpCloud signing certificate expired or was replaced.

Check the certificate expiration date and refresh the JumpCloud metadata under IdP Configuration.

The user can't access the SSO application.

The JumpCloud user group isn't bound to the application.

Open the JumpCloud application's User Groups tab and bind the appropriate group.

The user authenticates in JumpCloud but can't access CloudConnexa.

The user's group isn't bound to the SSO application. JumpCloud denies application access by default.

Open the JumpCloud application's User Groups tab and bind the appropriate group.

The application won't activate, and saving produces an error.

Include Group Attribute is enabled, but Groups Attribute Name is blank.

Enter memberOf in Groups Attribute Name or disable Include Group Attribute.

An issuer or audience mismatch persists after reviewing the values.

The configured IdP URL might be incorrect.

Verify the IdP URL and recheck both metadata sets. If the IdP URL is wrong, recreate the JumpCloud application because you can't change this value after creation.

© 2026 OpenVPN Inc. | OpenVPN is a registered trademark of OpenVPN, Inc. | CloudConnexa is a registered trademark of OpenVPN, Inc.

Service StatusPrivacy PolicyLegal