Identity providers

Connect JumpCloud

JumpCloud is common in companies that never had an on-premise directory and do not want one. Its custom SAML connector is straightforward, with one quirk worth knowing in advance: it asks for both an IdP entity ID and an SP entity ID, and mixing them up produces an error that names neither.

Before you start

An organization in Paycux for the customer, with their email domain claimed.
JumpCloud administrator access.
The ACS URL and entity ID from the Paycux connection.
A JumpCloud user group to assign the application to. JumpCloud assigns applications through groups rather than to individuals, so create one before you begin.

Create the SAML application

1In the JumpCloud admin console open SSO Applications, then Add New Application.
2Choose Custom Application, then select Manage Single Sign-On and configure SSO with SAML.
3Give the application a display name and upload your logo.
4Set IdP Entity ID to a stable identifier for the customer's JumpCloud instance — their own domain is the conventional choice.
5Set SP Entity ID to the Paycux entity ID for this connection.
6Set ACS URL to the Paycux ACS URL.
7Set SAMLSubject NameID to email and SAMLSubject NameID Format to the emailAddress format.
8Leave Sign Assertion enabled and save.

IdP Entity ID identifies the customer; SP Entity ID identifies your connection. Swapping them yields an audience mismatch on the Paycux side, which reads as a rejected assertion rather than as a misconfigured field.

Add the user attributes

JumpCloud calls these attribute statements and sends none by default. Add them on the same screen, under User Attribute Mapping.

Service provider attribute name	JumpCloud attribute name
email	email
firstName	firstname
lastName	lastname
id	id

Group attributes and assignment

If roles in your product depend on directory groups, enable group attributes on the application and name the attribute your connection expects. Then assign the application to the user groups that should have access — this is also what grants sign-in, so an application with no assigned group authenticates nobody.

jumpcloud-groups

1# SSO Applications -> uygulamaniz -> User Groups
2#   erisim verilecek gruplari isaretleyin
3 
4# Group Attributes bolumu
5Group Attribute Name:  groups
6# Gonderilecek gruplar uygulamaya atanan gruplarla sinirlidir.

Finish the connection in Paycux

1On the application's SSO tab, download the JumpCloud metadata or the IdP certificate.
2Copy the IDP URL from the same screen.
3Paste both into the Paycux connection, or upload the metadata file.
4Assign yourself to a group that has the application, then run a test sign-in.
5Confirm the profile carries an email, a name and a stable identifier, then activate the connection.

Turn on SCIM provisioning

1Create a directory in Paycux for the same organization, choose JumpCloud SCIM, and copy the base URL and token key.
2In JumpCloud, open the application and go to the Identity Management tab.
3Paste the base URL and the token key, then choose Test Connection.
4Enable Identity Management and select the groups to provision — usually the same groups you assigned for sign-in.
5Save, then watch the first sync complete before assigning the rest of the directory.

Keep the sign-in groups and the provisioning groups the same. When they drift apart you get accounts that exist but cannot sign in, or people who can sign in and have no account — both of which arrive as support tickets rather than as errors.

When it does not work

Symptom	Usual cause
Audience mismatch	IdP Entity ID and SP Entity ID were entered the wrong way round.
Nobody can sign in	The application is not assigned to any user group.
Profile has an email and nothing else	User attribute mapping was not filled in.
Identity Management test fails	The token key was regenerated in Paycux after being pasted.
Users provisioned but not deactivated	The person was removed from the group rather than suspended, and your handler treats those differently.
Groups arrive but mean nothing	No mapping exists yet between directory groups and your product's roles.

Directory Sync integrationHandling the provisioning events.Modeling roles and permissionsTurning group names into permissions.Enterprise SSO integrationThe code behind the connection.SSO glossaryEntity ID, ACS URL and name ID, defined.