# JumpCloud

1. Login to your JumpCloud admin account.
2. Navigate to SSO Applications\\

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/XdZjCDeAhQ06Jf8IfQRe/image.png" alt=""><figcaption></figcaption></figure>
3. Add a new SSO Application
4. Select "Custom" on this screen.

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/pja7Gb1PrkrWjHVkKdzr/image.png" alt=""><figcaption></figcaption></figure>
5. Select "Configure SSO with OIDC".

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/mvt1yX6JgBAA6ztzwyHF/image.png" alt=""><figcaption></figcaption></figure>
6. Fill the app's display label in the next form.\\

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/0AToMX6QKlvKzaYU7dOd/image.png" alt=""><figcaption></figcaption></figure>
7. After finishing this configuration, you will be redirected to your newly created SSO Application's settings. Go to the "SSO" tab first.

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/M53WE8bBQSWE1ggqWgqC/image.png" alt=""><figcaption></figcaption></figure>
8. Configure as following:

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/9CPgBxF1Y5exVuykM4QW/image.png" alt=""><figcaption></figcaption></figure>

   Make sure to set the correct Redirect URI and Login URL that will reflect your Defguard's setup. If you access your Defguard dashboard at e.g. `https://defguard.example.net` your redirect URI will be `https://defguard.example.net/auth/callback` and the login URL `https://defguard.example.net/auth/login`. Additionally, if you are using a Defguard proxy to enroll users, you can also add another redirect URI in the form of `<DEFGUARD_ENROLLMENT_URL>/openid/callback` and `<DEFGUARD_ENROLLMENT_URL>/openid/mfa/callback` if you wish to use the [External MFA feature](https://docs.defguard.net/1.5/wireguard/multi-factor-authentication-mfa-2fa#external-mfa) ( `<DEFGUARD_ENROLLMENT_URL>` is the address at which your Proxy enrollment page is accessible).
9. Next, select the profile scope and add an `email` user attribute mapping by hand, like so:

   <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/iCG2lamni15Y2GRuQMJA/image.png" alt=""><figcaption></figcaption></figure>

   It's important **not** to select the email standard scope checkbox, as it will automatically add a constant `email_verified` field which doesn't conform to the OpenID standard and doesn't work with Defguard. You can see the following section for more information: [#jumpcloud](https://docs.defguard.net/1.5/features/external-openid-providers/..#jumpcloud "mention").
10. Click "Activate". You will be presented with a client ID and a secret. Copy both of them, as you will need to insert them in Defguard's settings.
11. Go to Defguard settings, OpenID tab, select `JumpCloud` provider tab and paste the copied values:

    <figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2Fyj1DvoR9eI94PMFOYvHJ%2Fimage.png?alt=media&#x26;token=b5ca7f1b-6b3a-4c02-9466-03905b8d0812" alt=""><figcaption></figcaption></figure>
12. Back in JumpCloud, make sure your users have access to the SSO Application. You can enable it by navigating to the `User groups` menu and selecting the group you want to enable logging in through JumpCloud for. Only users from this group will be able to log in to Defguard with JumpCloud. In this example, we will select the `All users` group, which is a dynamic group containing every user.
13. Now in the group settings menu, select the `Applications` tab and select the checkbox next to your newly created app, this will enable the app for that group. Click `Save group` when you finish.

    <figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/a1ESiE3fi73xZRYzojiz/image.png" alt=""><figcaption></figcaption></figure>
14. Now you should be able to log in to Defguard with JumpCloud.

### Directory synchronization

Defguard supports synchronizing groups' and users' states based on your JumpCloud directory.

Make sure to check the [general guide to directory synchronization](https://docs.defguard.net/1.5/features/external-openid-providers/..#directory-synchronization) to learn more about the available configuration options.

#### Setup

{% hint style="warning" %}
Because JumpCloud API keys are bound to users and they don't support granular permissions nor generating more than one at a time, we recommend generating the API key for a user with read only permissions, as Defguard doesn't require write permissions to your directory.
{% endhint %}

1. Login to your [JumpCloud admin portal](https://console.jumpcloud.com/)
2. Generate a new API key (or use an existing one). This can be done by clicking your user icon in the upper right corner and selecting "My API key"<br>

   <figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2FKjMSABsQnZSzu8AMoZDw%2Fimage.png?alt=media&#x26;token=f2217578-a4cf-4ef1-8ac8-3e3da8992aa8" alt=""><figcaption></figcaption></figure>
3. If you already generated an API key, you will have to regenerate it here (please note that regenerating the API key may break your existing integrations that already use it).<br>

   <figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2FRAoU1xZrujCvPRA8Z7uL%2Fimage.png?alt=media&#x26;token=97e8d58f-0273-43a6-84b4-66358a98491e" alt=""><figcaption></figcaption></figure>
4. Copy the newly generated API key and navigate to your Defguard instance's settings.
5. Paste the key into the "JumpCloud API key" field<br>

   <figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2FLSOQSWSwP8HCNQVHhkQw%2Fimage.png?alt=media&#x26;token=f88a00a7-3e51-4112-a058-b62e5335a69f" alt=""><figcaption></figcaption></figure>
6. The JumpCloud directory synchronization should now work and your users' state and group memberships should be periodically synchronized.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.defguard.net/1.5/features/external-openid-providers/jumpcloud.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.