- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Full Admin account and BambooHR \u201cadvantage\u201d package at minimum<\/li>\n\n\n\n
- Your BambooHR tenant<\/li>\n\n\n\n
- Review Bamboo HR’s JumpCloud Integration<\/a> article<\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- Email BambooHR Support<\/a> to enable the JumpCloud integration on your account<\/li>\n\n\n\n
- Configuring JumpCloud SSO for BambooHR is recommended, but not required\n
- \n
- JumpCloud won\u2019t manage or consume the BambooHR password. Setting up SSO with the BambooHR User Portal will let your Users access the Bamboo portal using their JumpCloud credentials<\/li>\n\n\n\n
- JumpCloud managed users must have an email address that corresponds to an email address associated with a BambooHR account<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- BambooHR will be the identity source once the SCIM integration is configured and serves as the \u201cmaster\u201d for user attributes. Once that identity is in JumpCloud, admins can manage access, authentication, and extend that identity to all JumpCloud managed resources <\/li>\n\n\n\n
- The SCIM integration is managed by BambooHR. Please contact <\/a>BambooHR Support<\/a> for support<\/li>\n\n\n\n
- The SCIM integration only sends employee records – user records not sent<\/li>\n\n\n\n
- The SCIM integration is one-way – the employee identities are sent from BambooHR to JumpCloud<\/li>\n\n\n\n
- Bamboo sends both active<\/strong> and inactive<\/strong> employee records. You will need to monitor the users that are created to ensure any inactive employees that should not be in JumpCloud are deleted:\n
- \n
- You will need to contact your Account Manager or Account Services to let them know when this situation occurs, so billing can be managed appropriately<\/li>\n\n\n\n
- If you do not want inactive users to be created, you can remove the work email for the employees who are inactive and store it in the “notes” tab for future reference. Removing the work email value will prevent the records from syncing to Jumpcloud<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- We strongly recommend setting Staged <\/strong>as the user default for Manual \/ Single User API <\/strong>in Settings > User Management > Default User State for User Creation<\/strong> in JumpCloud. Read Manage User States<\/a> to learn more\n
- \n
- You can easily identify new users created by the integration<\/li>\n\n\n\n
- You can assign resources without granting access before the user’s start date<\/li>\n\n\n\n
- You can control whether or not an email is sent to the user when they are activated<\/li>\n\n\n\n
- You can activate the user by changing their user state<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When a user is created in BambooHR as an employee, they will automatically be created in JumpCloud on the next scheduled sync based on the settings for the JumpCloud app in BambooHR<\/li>\n\n\n\n
- If a specific minute is selected from the minute dropdown, that will result in data being sent at that minute past the hour every hour. It does not result in a sync occurring in that minute time interval. For example, selecting 5 for the minute will result in the data being sent to JumpCloud at 5 minutes past the hour every hour\n
- \n
- If you want to sync data more frequently than hourly, select the Every Day, Every Month, Every Hour, Every Minute options
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/BambooHR-Schedule-screen-2.png\")
<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n- \n
- A user created by this integration will:\n
- \n
- Be created in the user state specified for Default User State for User Creation <\/strong>for Manual \/ Single User API<\/strong><\/li>\n\n\n\n
- Have a pending password<\/strong> status<\/li>\n\n\n\n
- Need to establish and maintain their password within JumpCloud<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Users created in the Active<\/strong> user state won\u2019t automatically be sent an activation email upon creation <\/li>\n\n\n\n
- Updates to the user attributes specified in the settings for the JumpCloud app BambooHR will be synced to JumpCloud as long as the integration is active<\/li>\n\n\n\n
- Group import isn\u2019t supported <\/li>\n\n\n\n
- An employee record in BambooHR must have a company email address for the information to be sent to JumpCloud <\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \n- \n
- When you delete a BambooHR managed user in JumpCloud, that user still exists and has a work email address in BambooHR, the user will be recreated in JumpCloud. <\/li>\n\n\n\n
- When you suspend a user in JumpCloud and the user is still active in BambooHR, the user state for that user will updated and set back to Active<\/strong> in JumpCloud.<\/li>\n\n\n\n
- When you add a user in JumpCloud, the user won\u2019t be created in BambooHR.<\/li>\n\n\n\n
- When you do a manual sync from BambooHR to JumpCloud, a full sync is done, meaning all employee records, both active and inactive users are sent.<\/li>\n\n\n\n
- When you make any changes to the settings for the JumpCloud application in BambooHR, a full sync is done, meaning all employee records, both active and inactive users are sent.<\/li>\n\n\n\n
- There are other triggers that result in a full sync. Please contact <\/a>BambooHR Support<\/a> for more information.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Attribute Considerations<\/strong><\/h2>\n\n\n\n
- \n
- Any attributes that have been selected within BambooHR for export to JumpCloud will overwrite values existing in JumpCloud with each update that is triggered in BambooHR\n
- \n
- It’s recommended to Enable read-only on the user\u2019s portal profile page for all users<\/strong> in the Organization Settings<\/strong> to prevent users and administrators from updating attributes in JumpCloud<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Creating a new JumpCloud Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
<\/p><\/div>Note:<\/strong> SSO is either on or off. There is not an option to allow users to either login with SSO or login with their BambooHR credentials.<\/p><\/div><\/div><\/div>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab. <\/li>\n\n\n\n
- In the ACS URL<\/strong> field, replace <YOURDOMAIN> with your account’s registered BambooHR domain name.<\/li>\n\n\n\n
- Add or change any additional attributes.<\/li>\n\n\n\n
- Select save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure BambooHR<\/strong><\/h3>\n\n\n\n
- \n
- Log in to BambooHR as an administrator (This user’s email should also be managed by JumpCloud).<\/li>\n\n\n\n
- Select the Apps<\/strong> icon in the upper right.<\/li>\n\n\n\n
- Scroll down to the Single Sign-On<\/strong> section, and select the SAML 2.0<\/strong> icon.<\/li>\n\n\n\n
- Select the Install<\/strong> button next to the SAML 2.0<\/strong> icon.<\/li>\n\n\n\n
- Enter the following information:\n
- \n
- SSO Login URL<\/strong> – enter the JumpCloud IDP URL<\/strong>. <\/li>\n\n\n\n
- x.509 Certificate<\/strong> – copy and paste the contents of the certificate downloaded in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Optionally, select Allow optional email & password login<\/strong>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Important:<\/strong> \nThe “allow optional email & password login” enables employees to log in through [OneLogin\/Microsoft\/SAML\/etc] or type in their email and password. Please note that while this is an option, it’s recommend to leave this unchecked as installing a single sign-on option will disable the 2-Step Login in BambooHR.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Select Install<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Log in to the <\/a>JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- x.509 Certificate<\/strong> – copy and paste the contents of the certificate downloaded in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Scroll down to the Single Sign-On<\/strong> section, and select the SAML 2.0<\/strong> icon.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO <\/strong>tab. <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- It’s recommended to Enable read-only on the user\u2019s portal profile page for all users<\/strong> in the Organization Settings<\/strong> to prevent users and administrators from updating attributes in JumpCloud<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- Have a pending password<\/strong> status<\/li>\n\n\n\n
- Be created in the user state specified for Default User State for User Creation <\/strong>for Manual \/ Single User API<\/strong><\/li>\n\n\n\n
- A user created by this integration will:\n
- If you want to sync data more frequently than hourly, select the Every Day, Every Month, Every Hour, Every Minute options
- Configuring JumpCloud SSO for BambooHR is recommended, but not required\n
- Email BambooHR Support<\/a> to enable the JumpCloud integration on your account<\/li>\n\n\n\n