- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Splashtop account with the Owner role<\/li>\n\n\n\n
- A Splashtop Enterprise Plan<\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- SSO is required for Identity Management. Contact Splashtop to subscribe to the SSO feature.<\/li>\n\n\n\n
- If you need to update your token, you must deactivate the IdM integration<\/a>, update the token, and then reactivate the IdM integration.<\/li>\n\n\n\n
- Users who are suspended or have been removed from all user groups associated with the Splashtop integration in JumpCloud will still show as \u2018active\u2019 in Splashtop. These users will no longer be synced though.<\/li>\n\n\n\n
- Deleting a user who is part of one or more groups associated with Splashtop in JumpCloud will also delete the user in Splashtop.<\/li>\n\n\n\n
- We recommend adding a user to only one Splashtop managed group in JumpCloud, because a user can’t be a member of multiple synced groups in Splashtop. If a user is a member of more than one group managed by JumpCloud, the user will only be added to the most recently created JumpCloud managed group. If the most recently created JumpCloud managed group is deleted, the user will be moved to the second most recently created JumpCloud managed group of which the user is a member, and so on. If all JumpCloud managed groups of which a user is a member are deleted, the user will be added to the default group in Splashtop and remain active, but will no longer be managed by JumpCloud.<\/li>\n\n\n\n
- Users cannot be filtered by email.<\/li>\n\n\n\n
- The HTTP PATCH <\/kbd>method is not supported.<\/li>\n\n\n\n
- The HTTP DELETE <\/kbd>method works as a “hard delete” and wipes the user from the account.The same happens with groups<\/li>\n\n\n\n
- The HTTP PUT <\/kbd>method doesn’t support the update of the “activate”<\/kbd> user attribute, therefore when the user is deactivated <\/kbd>in JumpCloud it will still appear as activate <\/kbd>in the Splashtop account but the user won’t be updated or managed from JumpCloud unless it’s reactivated<\/kbd> by the admin.<\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details.<\/p>\n\n\n\n
- \n
- You must add a constant attribute ssoName<\/strong> to the SSO configuration in JumpCloud. The value must match the SSO Name value set in Splashtop. This value will be passed as a user attribute. Users and groups can’t be provisioned without this value.<\/li>\n<\/ul>\n\n\n\n
Creating a new JumpCloud Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure JumpCloud<\/strong> <\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- The default values set in the SSO<\/strong> tab contain all the necessary configuration details.<\/li>\n\n\n\n
- IDP URL<\/strong> can be customized or kept as the default.<\/li>\n\n\n\n
- If you want to do a service-provider initiated SSO flow, enter jumpcloud-login<\/strong> in the Default RelayState field.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Download the JumpCloud metadata<\/strong> file<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- The JumpCloud-<applicationname>-metadata.xml<\/strong> will be exported to your local Downloads <\/strong>folder.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nMetadata can also be downloaded from the Configured Applications<\/strong> list. Search for and select the application in the list and then click Export Metadata<\/strong> in the top right corner of the window.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Splashtop<\/strong><\/h3>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nFor more information on configuring JumpCloud for SSO with Splashtop see Splashtop\u2019s SSO setup – JumpCloud (SAML 2.0)<\/a> documentation. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Log in to the Splashtop portal<\/a>.<\/li>\n\n\n\n
- From the top navigation bar, select Management<\/strong> > Settings.<\/strong><\/li>\n\n\n\n
- From the left navigation bar of the Settings<\/strong> page, select Team<\/strong>.<\/li>\n\n\n\n
- Scroll down to the Single Sign On<\/strong> section.<\/li>\n\n\n\n
- Click Apply for new SSO method<\/strong>. Learn more about this in Splashtop’s How to Apply for a New SSO Method<\/a> documentation.<\/li>\n\n\n\n
- Enter an SSO Name<\/strong>.<\/li>\n\n\n\n
- Select JumpCloud<\/strong> for IDP Type<\/strong>.<\/li>\n\n\n\n
- Leave SAML 2.0<\/strong> as the Protocol<\/strong>.<\/li>\n\n\n\n
- Use the metadata import option at the bottom of the form to automatically populate the IDP SSO Login URL<\/strong>, IDP Issuer<\/strong>, and X.509 Certificate<\/strong> values.\n
- \n
- Select Upload an XML file<\/strong>.<\/li>\n\n\n\n
- Click Choose an XML file<\/strong>.<\/li>\n\n\n\n
- Upload the metadata file you downloaded from the JumpCloud administrator portal.<\/li>\n\n\n\n
- Click Import<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Clear the certificate information from the X.509 Certificate<\/strong> field. You will need to replace the certificate value, because it must be enclosed in —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–.<\/li>\n\n\n\n
- Open the certificate.pem file you downloaded from the JumpCloud admin portal and copy all the file contents<\/li>\n\n\n\n
- Paste the contents from the certificate file in X.509 Certificate<\/strong> field.<\/li>\n\n\n\n
- Enter your whitelisted domain(s), which are the domains for the users you want to provision within Splashtop.<\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n\n\n\n
- The Splashtop validation team will verify the SSO method information you entered. It may take 1-2 business days to complete the validation. The SSO method will remain in a pending status until the validation is complete.<\/li>\n\n\n\n
- You will receive an email to verify your domain(s). Follow the instructions in the email to complete the process.<\/li>\n\n\n\n
- Once your SSO method is validated and domain(s) verified, your SSO configuration is complete.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Access the JumpCloud User Console<\/a><\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- JumpCloud asserts the user’s identity to the SP and is authenticated without the user having to log in to the application<\/li>\n<\/ul>\n\n\n\n
SP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Go\u00a0to the SP application login – generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
This varies by SP.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Login redirects the user to JumpCloud where the user enters their JumpCloud credentials<\/li>\n\n\n\n
- After the user is logged in successfully, they are redirected\u00a0back to the SP and automatically logged in<\/li>\n<\/ul>\n\n\n\n
Configuring the Identity Management Integration<\/strong><\/h2>\n\n\n\n
To configure SplashTop<\/strong><\/h3>\n\n\n\n
- \n
- Log into Splashtop portal<\/a>.<\/li>\n\n\n\n
- Go to Management<\/strong> > Settings<\/strong> > Teams<\/strong> tab.<\/li>\n\n\n\n
- Scroll down to the SCIM Provisioning Token<\/strong> section. <\/li>\n\n\n\n
- Click the Set up an API token<\/strong> link.<\/li>\n\n\n\n
- Click Generate<\/strong>.<\/li>\n\n\n\n
- Copy the generated token.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nThe Client ID and Secret (token) may only be shown once. Copy them to a secure location, like the JumpCloud Password Manager<\/a>, for future reference.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- Go to Management<\/strong> > Settings<\/strong> > Teams<\/strong> tab.<\/li>\n\n\n\n
- Log into Splashtop portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Click Choose an XML file<\/strong>.<\/li>\n\n\n\n
- From the top navigation bar, select Management<\/strong> > Settings.<\/strong><\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- The default values set in the SSO<\/strong> tab contain all the necessary configuration details.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n