Skip to main content

Verify the Integrity of an Access Certification Audit Report

Every closed Access Certification campaign produces an audit report sealed with a SHA-256 document hash. The hash is a fingerprint of the report: if anything in the report changes (even if it is a single character), the fingerprint changes. You or your auditor can use it to confirm that a report is exactly what JumpCloud produced.

Before you begin​

  • Admins with Full Access or View to Access Certification can download reports.
  • An auditor doesn’t need a JumpCloud account. They need the JSON file of the report and the official document hash.
  • You don’t need to install anything. Windows, macOS and Linux include the tools used in this article.

How the document hash works​

A SHA-256 hash is a 64-character value calculated from the exact contents of a file. The same file always produces the same hash, and any change to the file produces a different one.

  • The hash is calculated from the JSON file: Each report can be downloaded in three formats. The .json file is the original record of the campaign, and it’s the only file the document hash is calculated from. The PDF and CSV files present the same information in a readable form.
  • What the hash covers: The campaign configuration, the overview, every identity with its access before and after the campaign, every decision with its reviewer, justification and timestamp, and every remediation outcome.
  • Sign-off changes the hash: When an admin signs off the report, JumpCloud adds the certifying admin and the sign-off time, regenerates the report and calculates a new hash, which replaces the previous one. From then on, downloads give you the signed version. A file downloaded before sign-off won’t match the new hash.
  • File names: Downloaded files are always named <campaign name>_<campaign ID>_audit.<format>, for example User-Exclusion_6ada2fde6c4c941707f441ec_audit.json.

Why the hash of the PDF or CSV never matches​

  • A hash is calculated from a file’s exact bytes, not from the information it shows. The PDF shows the same decisions as the JSON file, but it’s a different file, with its own layout, fonts, compression and document data. Different bytes always produce a different hash, even when the content looks the same.
  • The PDF contains the hash. A file can’t contain its own hash: writing the hash into the file would change the file, and so change its hash. That’s why the hash is calculated from the JSON file and the PDF only displays it.
  • The CSV is a different format. It’s a simplified table built from the same data, so its bytes, and its hash, are different too.

Step 1: Get the official document hash​

Use either of these sources:

  • Admin Portal: go to Access > Access Certification > Closed and locate the campaign. The document hash appears next to the Report sign off badge. Select the hash and copy it.
  • PDF report: Section 1, Report integrity, shows the algorithm (SHA-256) and the document hash.

Step 2: Download the JSON file​

  1. Go to Access > Access Certification > Closed.
  2. Find the campaign and select Download.
  3. Select .json. The file is saved as <campaign name>_<campaign ID>_audit.json.

Don’t open and save the file in an editor, copy and paste its contents, or save it from a browser’s formatted view. A single changed space or line break changes the hash. Renaming the file, sending it by email, or zipping and unzipping it doesn’t change the hash.

Step 3: Calculate the hash​

In the commands below, replace <file-name>.json with the name of your file, for example User-Exclusion_6ada2fde6c4c941707f441ec_audit.json. Keep the quotation marks, because campaign names can contain spaces. You can type the first letters of the name and press the Tab key to complete it.

Windows (PowerShell)​

  1. Open PowerShell: select Start, type PowerShell and open Windows PowerShell.
  2. Go to the folder where the file was saved, for example Downloads: cd $HOME\Downloads
  3. Run: Get-FileHash ".\<file-name>.json" -Algorithm SHA256

The value in the Hash column is the file’s hash. PowerShell shows it in uppercase letters. Case doesn’t matter when you compare hashes.

Windows (Command Prompt)​

  1. Open Command Prompt: Select Start, type cmd and open Command Prompt.
  2. Go to the folder where the file was saved: cd %USERPROFILE%\Downloads
  3. Run the following command: certutil -hashfile "<file-name>.json" SHA256

The line after “SHA256 hash of …” is the file’s hash.

macOS​

  1. Open Terminal: Press Command + Space, type Terminal and press Return key.
  2. Go to the folder where the file was saved: cd ~/Downloads
  3. Run the following command: shasum -a 256 "<file-name>.json"

The first value in the output, before the file name, is the file’s hash:
ad9901c97cfba73b50819f5b288a83d9914f3e5ec9d79caf7b7d6e5643ff4097 <file-name>.json

Linux​

  1. Open a terminal.
  2. Go to the folder where the file was saved: cd ~/Downloads
  3. Run: sha256sum "<file-name>.json"

The first value in the output, before the file name, is the file’s hash.
On macOS and Linux, you can also use openssl dgst -sha256 "<file-name>.json". The hash appears after the equals sign.

Step 4: Compare the hashes​

Compare the hash you calculated with the official document hash from Step 1. All 64 characters must be the same. Uppercase and lowercase letters count as the same character.
To compare them automatically, replace <official hash> with the hash from Step 1:

  • PowerShell: the command returns True when the hashes match and False when they don’t.
    (Get-FileHash ".\<file-name>.json" -Algorithm SHA256).Hash -eq "<official hash>"
  • macOS: the command returns the file name followed by OK when the hashes match. Paste the hash in lowercase, and keep two spaces between the hash and the file name.
    echo "<official hash> <file-name>.json" | shasum -a 256 -c
  • Linux: same as macOS, using sha256sum.
    echo "<official hash> <file-name>.json" | sha256sum -c

If the hashes match, the file is exactly what JumpCloud generated when the campaign closed, or when the report was signed off.
A matching hash shows that the file hasn’t changed since JumpCloud generated it. It doesn’t confirm that the review decisions are correct or that your organization meets any compliance standard. The decisions and the sign-off are your organization’s attestations.
If they don’t match, check the causes in the next section before you conclude that the report was changed.

Reasons for Hash Mismatch​

The hashes may not match due to various reasons. Here are some of the reasons:

  • You hashed the PDF or CSV. Hash the .json file.
  • The file was downloaded before sign-off. Download the JSON file again and compare it with the current hash.
  • The file was opened and saved, or saved from a browser’s formatted view. Download it again from the Admin Portal.
  • The download was incomplete. Download it again.
  • You compared the hash partially. Use all 64 characters.
  • The file belongs to another campaign or another run. Check the campaign name and ID in the file name, and the close date.

Sharing a report with an auditor​

Send the JSON file, the PDF, and the official document hash to the auditor. For the strongest assurance, have the auditor read the hash directly from the Admin Portal, for example during a screen share, rather than only from files you send them. Keep the JSON file, the PDF and the document hash together in your own records for as long as your retention requirements demand.

Was this information helpful?