Skip to content

Index

import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs";

authentik can synchronize users and groups from JumpCloud using an LDAP source or a SCIM source. LDAP also lets users log in with their JumpCloud passwords. SCIM provisions directory data only and requires a separate authentication method.

Preparation

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

<Tabs defaultValue="ldap" values={[ { label: "LDAP", value: "ldap" }, { label: "SCIM", value: "scim" }, ]}

Configure LDAP

Configure JumpCloud

Create an LDAP binding user

Create a binding user as described in JumpCloud's Cloud LDAP documentation:

  1. Log in to the JumpCloud Admin Portal.
  2. Navigate to Identity Management > Users and create a binding user that matches your naming scheme.
  3. Open the user, and under Details > User Security Settings and Permissions > Permission Settings, enable Enable as LDAP Bind DN.
  4. Save the user.

Assign users and groups to LDAP

Only assigned users and groups are available over LDAP. Groups must contain at least one user to appear in LDAP. See Create an LDAP group.

  1. Navigate to Access > LDAP.
  2. Open the User Groups tab and select the groups whose members authentik should synchronize. Binding a group grants all of its members access to the LDAP directory.
  3. Open the Users tab and confirm that the accounts you expect to sync, including the binding user, are present. Add any individual users that are not covered by a bound group.
  4. Save your changes.
  5. Note your JumpCloud Organization ID for the Base DN in the next section.

Create the LDAP source in authentik

The example below uses the US LDAP endpoint. For other regions, use the hostname listed in JumpCloud's Cloud LDAP documentation.

authentik uses one Object uniqueness field for both users and groups. This configuration uses cn, which must be unique among synchronized users and among synchronized groups. JumpCloud uses the user's full name for cn, so check for duplicate names before synchronizing. Changing a cn changes the object's identifier in authentik. Use SCIM if you cannot keep these names unique and stable.

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Federation and Social login, click Create, select LDAP Source, and click Next.

  3. Provide a name and slug. Disable User password writeback, because JumpCloud's LDAP service is read-only. Configure the following settings:

    • Under Connection settings:

      • Server URI: ldaps://ldap.jumpcloud.com
      • Enable StartTLS: disabled
      • Bind CN: the LDAP DN shown in the binding user's JumpCloud details
      • Bind Password: the binding user's password
      • Base DN: ou=Users,o=<organization_id>,dc=jumpcloud,dc=com, using the Organization ID from JumpCloud

    • Under LDAP Attribute mapping:

      • User Property Mappings: select only authentik default OpenLDAP Mapping: uid, authentik default OpenLDAP Mapping: cn, and authentik default LDAP Mapping: mail.
      • Group Property Mappings: select only authentik default OpenLDAP Mapping: cn.

    • Under Additional settings:

      • User object filter: (objectClass=inetOrgPerson)
      • Group object filter: (objectClass=groupOfNames)
      • Object uniqueness field: cn

  4. Click Finish.

  5. Open the source, go to the Sync tab, and click Run sync again. Check that users, groups, and memberships synchronize successfully.
  6. In Flows and Stages > Stages, edit the password stage used by your authentication flow. Ensure that User database + LDAP password is selected as a backend, then test logging in with a synchronized user's JumpCloud credentials.

Configure SCIM

JumpCloud must be able to reach your authentik SCIM endpoint over HTTPS.

Create the SCIM source in authentik

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Federation and Social login, click Create, and select SCIM Source.
  3. Provide a Name, set the Slug to jumpcloud, and click Finish. The slug is used in the SCIM Base URL in the next step.
  4. Open the newly created source. Note the SCIM Base URL (https://authentik.company/source/scim/jumpcloud/v2), then use Click to copy token to copy the bearer token. Both are required in the next section.

Configure JumpCloud provisioning

Create a custom SCIM integration in JumpCloud:

  1. Log in to the JumpCloud Admin Portal as an administrator.
  2. Navigate to Access > SSO Applications and click Add New Application.
  3. Select URL Bookmark.
  4. Set the display label to authentik and the URL to https://authentik.company. Save and open the application.
  5. Open the Provisioning tab and configure the following settings:
    • Base URL: https://authentik.company/source/scim/jumpcloud/v2
    • Token: the bearer token copied from the authentik SCIM source.
    • Test User Email: an email address that does not already exist in authentik.
  6. Click Test Connection.
  7. After the connection succeeds, enable Enable management of User Groups and Group Membership in this application to provision groups and their memberships.
  8. Click Activate. JumpCloud creates, updates, and deletes a test user and group to validate provisioning.
  9. Open the application's User Groups tab and bind the groups whose members JumpCloud should provision into authentik. Confirm that the assigned users, groups, and memberships appear in authentik.