# JumpCloud

Steps verified in the identity provider's admin console.

Recommended protocol: SAML 2.0.

## SAML 2.0

### Connect JumpCloud with SAML 2.0

1. In the JumpCloud Admin Portal go to Access \> SSO Applications and click + Add.

   ![SSO Applications page with the Add button](/assets/idp-guides/jumpcloud/saml-1.png)

2. Under Custom Application click Select and then Next. Select Manage Single Sign-On (SSO), keep Configure SSO with SAML and click Next.

   ![Manage Single Sign-On (SSO) with Configure SSO with SAML selected](/assets/idp-guides/jumpcloud/saml-2.png)

3. Enter a Display Label and click Next; JumpCloud saves the application. Click Configure Application.

   ![Application ready to configure with the Configure Application button](/assets/idp-guides/jumpcloud/saml-3.png)

4. On the SSO tab enter an IdP Entity ID (required; any unique value, for example the IdP URL shown further down). Then either upload the KeenAuth metadata saved as a file from **SP metadata URL** under Service Provider Metadata (Choose A File), or enter SP Entity ID **SP entity ID** and, under ACS URLs, Default URL **ACS URL**.

   ![SSO tab with IdP Entity ID, SP Entity ID and ACS URL](/assets/idp-guides/jumpcloud/saml-4.png)

5. Keep SAMLSubject NameID as email, set SAMLSubject NameID Format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress and Sign to Assertion and Response. Under User Attributes click Add Attribute for each of email, firstName and lastName (Service Provider Attribute Name) with the JumpCloud Attribute Name email, firstname and lastname. For group mapping select Include Group Attribute and set Groups Attribute Name to groups. These names match the KeenAuth JumpCloud profile. Click Save.

   ![User attributes and Include Group Attribute with Groups Attribute Name](/assets/idp-guides/jumpcloud/saml-5.png)

6. Under JumpCloud Metadata use Export Metadata or Copy Metadata URL and give it to KeenAuth. Authorize users on the User Groups tab.

   ![User Groups tab of the application](/assets/idp-guides/jumpcloud/saml-6.png)


Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.