Subscribe to Help Center RSS FeedEasily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP) with JumpCloud. This allows your users to securely access their devices by logging in with their IdP credentials.
Prerequisites
- You need to have JumpCloud set up as an OIDC app in your IdP with the appropriate settings enabled to continue setting up Federated Authentication for your org, see our IdP configuration documentation to learn more:
- You need to have Admin with Billing permissions to configure an IdP.
- You need to have an existing IdP managing your users to benefit from federated authentication.
- All JumpCloud users must have unique company email addresses, and the email of the JumpCloud user and external IdP email used for Federation have to match.
Considerations
- Federated IdP authentication doesn’t capture the user’s IdP password. If Device Password Sync is set to NO, then users will be prompted to create a local passcode (password) on Mac or local PIN on Windows. If Device Password Sync is set to Yes, then JumpCloud will sync the JumpCloud password to the device and set it for the user account on the device.
- Federation does not currently support authenticating with JumpCloud Go.
- Federation does not currently support JumpCloud Multi-Factor Authentication (MFA) for users in addition to external IdP authentication. However, MFA may be applied at the IdP.
Externally Managed Passwords
Externally managed passwords prevent password changes within JumpCloud, both by users and admins. When users are set to Password Externally Managed, they will no longer receive password expiration notifications and password expirations will no longer apply to them.
Use this setting when a user’s password is being managed by an upstream integration or when they’re authenticating with an external identity provider (IdP).
Note: Once this setting is enabled, users will not be able to change their own password from their JumpCloud device tray application, User Portal, or any other password reset flow. Additionally, admins won’t be able to set user passwords from the Admin Portal.
Workflow
- Prepare your IdP to configure with JumpCloud.
- You will need to add JumpCloud as an application to your IdP with the appropriate settings enabled to continue setting up Federated Authentication for your org, see our IdP configuration documentation:
- Configure your IdP in JumpCloud.
- Verify that you want to enable Federated Device Authentication for your users’ login.
- This will require all users to authenticate with their IdP.
- Verify that you want to enable Federated Device Authentication for your users’ login.
- Automatically bind users to devices by configuring Self Service Account Provisioning, or Automated Device Enrollment, based on whichever OS you’re provisioning, see Provision New Users on Device Login to learn more.
- Users logging into their device for the first time will use their IdP credentials to sign in. This also creates a local user on the device.
- By default, any new users that are associated with the device will automatically have their JumpCloud password synced to their device password. You can disable this so that any new user to device associations will not have their JumpCloud password synced to their device. Instead, the user will enter a local password to log into their device. See Device Password Sync to learn more.
- The JumpCloud account will be automatically bound to the JumpCloud device upon successful user login to the external IdP.
- Optionally, restrict your user’s password in JumpCloud.
- Users won’t be able to set or update a password in JumpCloud. Users won’t receive any password related communication or emails.
- Admins won’t be able to set or update a user’s password in JumpCloud either.
- Passwords can continue being synced from any SCIM or REST integration for this user.
FAQ
No. During the federated login flow, JumpCloud does not capture the IdP password.
- Admins need to decide whether they want their users device passwords synced or not.
- If password sync is set to No, then during the local account join, the user will be prompted to set a local passcode (Mac) or PIN (Windows). This is a local passcode to the device, which is not synced to or from JumpCloud.
Any resource that supports browser-based logins: User Portal, SSO apps, Self Service Account Provisioning, Mac ADE, and local password resets.
Any resource that does not support browser-based logins: LDAP and RADIUS
- Both Windows and Mac users can reset their PIN or local password from the device login window. See Windows/Mac Self-Service PIN/Password Reset for Local Password Users to learn more.
Account lockout applies to all users in an organization. If all users will authenticate with an IdP, and therefore use a local device credential, the OS lockout mechanisms may be used. In this case, JumpCloud account lockout doesn’t need to be configured. However, even if JumpCloud account lockout is configured, it can be overridden for individual users on devices by navigating to USER MANAGEMENT > Users, clicking a specific user, then under the User Security Settings and Permissions dropdown, select Bypass account lockout policy for user’s managed device.
Mac (and Windows): Admins can unlock the account in the Admin Portal, see Unlock User Accounts to learn more.
Yes. You can create a routing policy to have specific groups of users required to authenticate through their IdP. See Routing Policies for Identity Providers to learn more.
Yes, however this will prevent the user self service password reset flow from functioning by obscuring the Self Service Account Provisioning option.
The user will not know their local account device password unless they explicitly set it after login with PIN or biometric. This will result in denied logins, and could lead to lockouts by the OS or on the JumpCloud account, if configured.
- Windows: No. A randomized complex password value is set upon account creation. The PIN is set by the user and leverages the Windows default PIN length (6 digits).
- Mac: Yes. The password length and complexity settings are pushed to the device and enforced. Aging settings are not evaluated.
Yes, accounts can be manually bound to devices in the Admin Portal. Use the Password Sync dropdown to determine if the user's JumpCloud password will be synced to the device or not. For Federated accounts where the user logs into the device with a local password or PIN, set Password Sync to No.
Learn More
This could be caused by an issue with the configuration for the Identity Provider on the JumpCloud side or on the OIDC Client App on the Identity Provider side. Check the details of your configuration, and make sure your client ID and secret are correct. It may be necessary to regenerate a new secret in your IdP and try the configuration again if the problem keeps happening.
In this Article
Learn More