Skip to main content

JumpCloud

authentik can synchronize users and groups from JumpCloud using an LDAP source or a SCIM source. LDAP also lets users log in with their JumpCloud passwords. SCIM provisions directory data only and requires a separate authentication method.

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

Configure LDAP​

Configure JumpCloud​

Create an LDAP binding user​

Create a binding user as described in JumpCloud's Cloud LDAP documentation:

  1. Log in to the JumpCloud Admin Portal.
  2. Navigate to Identity Management > Users and create a binding user that matches your naming scheme.
  3. Open the user, and under Details > User Security Settings and Permissions > Permission Settings, enable Enable as LDAP Bind DN.
  4. Save the user.

Assign users and groups to LDAP​

Only assigned users and groups are available over LDAP. Groups must contain at least one user to appear in LDAP. See Create an LDAP group.

  1. Navigate to Access > LDAP.
  2. Open the User Groups tab and select the groups whose members authentik should synchronize. Binding a group grants all of its members access to the LDAP directory.
  3. Open the Users tab and confirm that the accounts you expect to sync, including the binding user, are present. Add any individual users that are not covered by a bound group.
  4. Save your changes.
  5. Note your JumpCloud Organization ID for the Base DN in the next section.

Create the LDAP source in authentik​

The example below uses the US LDAP endpoint. For other regions, use the hostname listed in JumpCloud's Cloud LDAP documentation.

authentik uses one Object uniqueness field for both users and groups. This configuration uses cn, which must be unique among synchronized users and among synchronized groups. JumpCloud uses the user's full name for cn, so check for duplicate names before synchronizing. Changing a cn changes the object's identifier in authentik. Use SCIM if you cannot keep these names unique and stable.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Directory > Federation and Social login, click Create, select LDAP Source, and click Next.

  3. Provide a name and slug. Disable User password writeback, because JumpCloud's LDAP service is read-only. Configure the following settings:

    • Under Connection settings:

      • Server URI: ldaps://ldap.jumpcloud.com
      • Enable StartTLS: disabled
      • Bind CN: the LDAP DN shown in the binding user's JumpCloud details
      • Bind Password: the binding user's password
      • Base DN: ou=Users,o=<organization_id>,dc=jumpcloud,dc=com, using the Organization ID from JumpCloud

    • Under LDAP Attribute mapping:

      • User Property Mappings: select only authentik default OpenLDAP Mapping: uid, authentik default OpenLDAP Mapping: cn, and authentik default LDAP Mapping: mail.
      • Group Property Mappings: select only authentik default OpenLDAP Mapping: cn.

    • Under Additional settings:

      • User object filter: (objectClass=inetOrgPerson)
      • Group object filter: (objectClass=groupOfNames)
      • Object uniqueness field: cn

  4. Click Finish.

  5. Open the source, go to the Sync tab, and click Run sync again. Check that users, groups, and memberships synchronize successfully.

  6. In Flows and Stages > Stages, edit the password stage used by your authentication flow. Ensure that User database + LDAP password is selected as a backend, then test logging in with a synchronized user's JumpCloud credentials.