Subscribe to Support RSS FeedAutomatically provision, update and deprovision users and groups in TeamRetro from JumpCloud using the Identity Management (SCIM) integration. Leverage this integration to centralize user lifecycle, user identity, and group management in JumpCloud for TeamRetro. Save time and avoid mistakes, as well as potential security risks, related to manually creating users and groups.
Read this article to learn how to setup the TeamRetro integration.
Prerequisites
- A JumpCloud administrator account.
- A TeamRetro enterprise plan.
- The Organization Owner role in TeamRetro.
- TeamRetro SCIM API is based on version 2.0 of the SCIM standard.
- Groups are supported.
- Groups are provisioned in TeamRetro but they’re not visible within TeamRetro’s admin portal.
Attribute Considerations
- A default set of attributes are managed for users. See the Attribute Mappings section for more details.
Group Management Important Considerations
Enabling Group Management
You must select the Enable management of User Groups and Group Membership in this application option to manage groups and group membership in the application from JumpCloud.
Group Provisioning and Syncing
- Empty groups are not created.
- JumpCloud takes over management of existing groups in the application when the user group name in JumpCloud matches the name of the group in the application.
- All user groups associated with the application in JumpCloud are synced. Syncing occurs whenever there is a membership or group change event.
- Group renaming is supported.
- If a user group is disassociated from the application in JumpCloud, syncing immediately stops and the group is left as-is in the application. All members of that user group are deactivated in the application unless they are associated with another active application group that is managed from JumpCloud.
Group Deletion
- Managed groups deleted in JumpCloud are deleted in the application.
- All members of the deleted group are deactivated in the application, unless they are associated with another active application group that is managed from JumpCloud.
Disabling Group Management
- You can disable group and group membership management by unchecking the Enable management of User Groups and Group Membership in this application option.
- The managed groups and group membership are left as-is in the application.
- JumpCloud stops sending group membership information for the user, but the user’s identity will continue to be managed from JumpCloud.
Configuring the Identity Management Integration
To Configure TeamRetro
- In TeamRetro, browse to [ORGANIZATION] > SETTINGS > SINGLE SIGN ON
- Click CREATE API KEY.
- Toggle SCIM to enabled (you may wish to disable Read and Write API access also).
- Click CREATE.
- Copy the unique SCIM API key to use later in JumpCloud. This value will be entered in the Token Key field in the JumpCloud Identity Management tab.
- Click SAVE CHANGES
- Copy one of the SCIM URLs to paste in the Base URL in the JumpCloud Identity Management tab:
- If you are hosted in the default US environment:
https://scim.teamretro.com - If you are hosted in the EU environment:
https://scim.eu.teamretro.com
- If you are hosted in the default US environment:
To Configure JumpCloud
- Log in to the JumpCloud Administrator Portal: https://console.jumpcloud.com.
- Go to USER AUTHENTICATION > SSO.
- Click ( + ) to configure a new application.
- Search for TeamRetro, then click configure.
- Enter a Display Label in the General Info tab. Optionally, you can enter a description and adjust the logo shown for the application.
- Click Activate.
- Find TeamRetro in the application list on the SSO page and click anywhere in the row to reopen the application configuration panel.
- Select the Identity Management tab.
- Select the Enable management of User Groups and Group Membership in this application checkbox if you want to provision, manage, and sync groups in TeamRetro from JumpCloud.
- Click Configure.
- You’re presented with two fields:
- *Base URL: Paste the SCIM Endpoint you copied when configuring TeamRetro. (e.g., https://scim.teamretro.com or https://scim.eu.teamretro.com )
- Token Key: Paste the SCIM token you generated when configuring TeamRetro.
- Click save.
- You will receive a confirmation that the Identity Management integration has been successfully verified.
- You can now connect user groups to the application in JumpCloud to provision the members of that group in TeamRetro. Learn how to Authorize Users to an Application.
Attribute Mappings
The following table lists attributes that JumpCloud sends to the application. See Attribute Considerations for more information regarding attribute mapping considerations.
Learn about JumpCloud Properties and how they work with system users in our API.
TeamRetro User Attributes
| JumpCloud Property | JumpCloud UI Field Name | SCIM v2 Mapping | TeamRetro Value |
|---|---|---|---|
| username | Username | Username | userName |
| firstname | First Name | name.givenName | firstname |
| lastname | Last Name | name.familyName | lastname |
| firstname/lastname | First Name/Last Name | name.formatted | Name |
| active | Status | active | active |
| phoneNumbers.value | Work Phone | phoneNumbers.value | phoneNumbers.value |
| addresses.locality | Work City | addresses.locality | addresses.locality |
| addresses.region | Work State | addresses.region | addresses.region |
| addresses.country | Work Country | addresses.country | addresses.country |
| addresses.postalCode | Work Postal Code | addresses.postalCode | addresses.postalCode |
| employeeIdentifier | Employee ID | externalID | externalID |
| preferredLanguage | preferredLanguage | preferredLanguage | preferredLanguage |
| displayname | Display Name | displayName | displayName |
| locale | Locale | locale | locale |
Group Attributes
| JumpCloud Property | JumpCloud UI Field Name | SCIM v2 Mapping | Application Value |
|---|---|---|---|
| name | Name | displayName | Organization |
Removing the IdM Integration
To deactivate the IdM Integration
- Log in to the JumpCloud Admin Portal.
- Go to USER AUTHENTICATION > SSO.
- Search for the application that you’d like to deactivate and click to open its details panel.
- Under the company name and logo on the left hand panel, click the Deactivate IdM connection link.
- Click confirm.
- If successful, you will receive a confirmation message.
- You can now delete the application.
To delete the application
- Log in to the JumpCloud Admin Portal.
- Go to USER AUTHENTICATION > SSO Applications.
- Search for the application that you’d like to delete and click to open its details panel.
- Check the box for the application.
- Click Delete.
- Enter the number of the applications you are deleting
- Click Delete Application.
- If successful, you will see an application deletion confirmation notification.
In this Article