Integrate with 15Five

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. Automatically provision, update and deprovision users and groups in 15Five from JumpCloud using the SCIM integration. Leverage this integration to centralize user lifecycle, user identity, and group management in JumpCloud for 15Five. Save time and avoid mistakes, as well as potential security risks, related to manually creating users.

Read this article to learn how to configure the 15Five integration. 

Prerequisites

• A JumpCloud Administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• A 15Five Administrator account
• 15Five Plus Plan. If using SSO, an SSO add-on is required. Contact 15Five support
• Your 15Five subdomain name

Important Considerations 

• SAML SSO is recommended, but not required:
  • To enable SSO, but require users to log in through 15Five and not the JumpCloud User Portal, deselect Show in User Portal in the General Info tab of the application window
• 15Five supports password synchronization:
  • If SSO is enabled, password changes don’t occur for the user in 15Five if the password is set from JumpCloud
  • If SSO isn’t enabled in 15Five, then the user will receive an email with a link to reset their password in 15Five
• If you delete an integrated 15Five application from your Applications list, the application is removed from JumpCloud, but any previously bound users remain active in 15Five. These users can log in to 15Five with the password they used before you enabled SSO with 15Five in JumpCloud
• If you deactivate SCIM on your 15Five application and SSO is activated, previously bound users remain active in 15Five and can authenticate using SSO. No further updates are made to user accounts via the SCIM integration:
  • Users created via SCIM integration should also be deleted via SCIM integration. Otherwise, you need to disable the user before you can delete  them
• Users deactivated via the SCIM integration can only be deleted via the SCIM integration after you reactivate them and then delete them
• Account takeovers are supported
• New users provisioned from JumpCloud receive an email invitation from 15Five
• Users are moved to the inactive state when they’re deprovisioned 
• If a user’s password expires in JumpCloud, their account becomes suspended and they are deactivated in all applications that have SCIM configured and, are associated to them. Once the user’s password is updated, the account and previously associated applications are reactivated
• Groups are supported

Attribute Considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details
• The username and email should match

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Click + Add New Application.
4. You can also enter the name of the application in the Search field and select it.
5. You can either select an application from the available list or select Custom Application, and click Next.
6. Select the required options from the Select Options page and click Next. The Enter General Info page is displayed.
7. On the Enter General Info page, you can customize the display label, description and how the application displays:
   • Description - add a description that users will see in their user portal
   • User Portal Image - choose Logo or Color Indicator
   • Show in User Portal - select to ensure the app is visible in the user portal
8. Optionally, expand the Advanced Settings section and customize the IdP URL:
   • Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https://sso.jumpcloud.com/saml2/{custom_value})

9. Click Save Application.
10. Next, click:
    • Configure Application and go to the next section
    • Close to configure your new application at a later time

Configuring the SSO Integration

To navigate to your JumpCloud SSO connector

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Create a new application or select it from the Configured Applications list.
4. Select the SSO tab.

To configure JumpCloud

1. In the IdP Entity ID and ACS URL fields, replace YOURDOMAIN with your 15Five subdomain name. 
2. Optionally, configure:

3. Click Save.

Copy the metadata URL

1. Find your application in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Select the SSO tab and click Copy Metadata URL.
3. The URL will be copied to your clipboard.

To configure 15Five

1. Navigate to the ’SAML Single Sign-On’ page in 15Five. If you don’t have access to that page, contact 15Five Support and they will add it for you.
2. Set your company's subdomain—typically this will be your company name or some form of it. You can choose anything they want as long as it does not contain characters, capital letters, or spaces. The subdomain name needs to also be a unique name—no other company can be using the same domain.
   • Click Save.
3. You will be taken to the next page to enter the Metadata from your IdP and set your SSO contact.
   • The Contact email should be the email of the IT point of contact that 15Five Support or others in your company should reach out to about SSO-related questions or issues.
   • Check the box labeled Automatically update metadata if you’d like to include the link to where 15Five can check your metadata. Doing so will allow 15Five to automatically update your metadata if changes are made, rather than updating the metadata manually.
   • Click Save.
4. Next, you will set your SAML attributes and settings.
   • SAML Single Sign-On Enabled: Should be checked to enable SSO.
   • Allow Password Sign In: Can be checked if you want their users to have the ability to log in using their email and password, rather than just through SSO. This can be turned on during testing and turned off after if preferred.
   • Allow Identity Provider Initiated Login: A setting that allows employees to log in directly from the app dashboard when they log in via your company’s IdP.
   • Allow Auto Login: Indicates that the employee will be auto-logged in using their IdP, instead of having to re-authenticate before logging in. This option only works if the ’Allow Password Sign-In’ option is disabled.
   • Allow Creation of New Users (JIT Provisioning): Automatically creates a new, paid account in 15Five if an employee who has access to 15Five in your IdP attempts to log into 15Five.

5. • Require Reviewer Selection: Requires an employee to choose their reviewer upon signing in for the first time. Such a choice will only be presented if reviewer information has not been passed in the SAML response. Most customers will want this off. 
   • Ensure assertions are signed and Ensure messages are signed: Tell 15Five what to expect from your IdP. You must have at least one of the two checked in order to proceed, but you are able to turn one setting off depending on your setup.
   • The next four lines show the Service Provider User Sign In URL, IdP Entity ID, etc. These fields are auto-populated by pulling from the XML metadata you entered on the previous screen.
6. The bottom half of the page is where you set your attributes. The best way to know what should go in here is to check your IdP’s attribute mappings. If you need some guidance, the blue link labeled Attributes Help may be helpful. The Name ID Contents and Email attribute name are the ones that are necessary to set up SSO, but there are a few others that you may want to sync.

If you would like the employee’s reviewer to sync to 15Five, and you do not use another integration with 15Five like SCIM or another HRIS, then you would put the reviewer information under the ‘Reviewer Attributes’ section. Make sure to click Save!

Authorizing SSO Application Access

Users are implicitly denied access to SSO Applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page. 

To authorize user access from the SSO Application’s page

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save. 

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

Check your SP's documentation to ensure that both workflows are supported.

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Configuring the SCIM Integration

To configure 15Five

1. Log in to 15Five with your administrator account.
2. In the left menu, click Settings > Features. 
3. Click Integrations > Manage, and enable the SCIM 2.0 option, then click Save.
   • If you don’t see the SCIM 2.0 integration, contact 15Five’s support team and request they activate it
4. Generate your access token.

To navigate to your JumpCloud SCIM connector

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Create a new application or select it from the Configured Applications list.
4. Select the Provisioning tab.

To configure JumpCloud

1. Click Configure in the Configuration Settings section.
2. You're presented with two fields:
   • Base URL: Paste in the SCIM 2.0 base URL you copied when you enabled SCIM 2.0 with JumpCloud in 15Five, e.g., https://my.15five.com/scim/v2
   • Token Key: Paste the access token generated in the previous section
3. Review and edit any user attribute mappings.
4. Click Activate.

Attribute Mappings

The Export Attributes Mapping table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations. 

Learn about JumpCloud Properties and how they work with system users in our API. 

Modifying User Attributes

To add user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit. The Optional Mappings table will open.
3. Scroll to the bottom of the table and click +Add Attribute.
4. Select one of the mapping types:
   • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
     • From the JumpCloud Attribute dropdown, select the desired attribute
       • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
     • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.
5. Repeat these steps for additional attributes.
6. Click Preview Mappings to review the User Schema.
   • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.

7. Click Update.

To modify existing user attributes

This enhancement gives you complete control over the user attributes sent from JumpCloud to this application. You can now:

• Fully control mappings - define which JumpCloud attribute or source data corresponds to an attribute in the SP's SCIM schema
• Use a variety of source values - map data from the user's standard attributes, Manager field, custom attributes, or other data sources
• Manipulate data with expressions - transform data, such as preferred first names and date format, using expressions before transmission to the SP. Learn more
• Preview changes - review your new mappings to ensure accuracy before you save

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit.
3. For the type of attribute you would like to modify:
   • Direct - select the new attribute from the dropdown(s)
   • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
   • Custom - delete the existing values in either or both of the attribute fields and enter the new values
4. Click Preview Mappings to review the updated User Schema.
5. Click Update.

Deleting user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
3. Click Delete () to remove any optional attributes.

4. When finished, click Update.

Restoring default user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
3. Scroll to the bottom of the table and select Restore Defaults.
4. Click Update and then click Save.

SCIM Directory Insights Events

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data being added or updated from HR or other external solutions to JumpCloud.

SCIM DI Group Events

Removing the Integration

To deactivate the SCIM Integration

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open the configuration window. 
4. Click Actions > Deactivate IdM and then click confirm.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO. 
7. Click Save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.