Skip to main content

Enable JumpCloud for SSO

Connect docs via MCP

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing JumpCloud credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new SAML app in JumpCloud, then import JumpCloud's identity provider metadata back into Atlan.

Start in Atlan, build and configure the app in JumpCloud, then return to Atlan to finish. Group sync is optional and covered at the end.

Prerequisites​

Before you begin, make sure you have:

  • Admin access in Atlan. Only admins can configure SSO.
  • Administrator access in JumpCloud so you can create a SAML application and assign user groups.
  • A decision on the default role new users receive on first sign-in (Admin, Member, or Guest). Set it in Set default role for SSO users. Most workspaces use Member.

Get Atlan's service provider details​

Before setting up the app in JumpCloud, get the values Atlan provides.

  1. In your Atlan workspace, click Settings from the left menu.

    If you are using the Old UI (Classic), from the left menu, click Admin.

  2. Click SSO.

  3. Click New, then select Jumpcloud as the provider.

  4. Under Service provider metadata, copy all three values: you'll paste them into JumpCloud in the next step:

    • IdP Entity ID
    • SP Entity ID
    • ACS URL

Keep this tab open. You'll return here to finish setup.

Configure in JumpCloud​

All the app setup happens in the JumpCloud console: create the application, configure SAML fields and attribute mappings, collect the IdP metadata, and assign user groups.

Create SAML application​

In the JumpCloud console:

  1. In the left menu, click Access Management (or Access), then click SSO Applications.

  2. Click + Add New Application.

  3. Click Custom Application, then click Next.

  4. Select Manage Single Sign-On (SSO), then select the Configure SSO with SAML radio button and click Next.

  5. Under General Info, enter a Display Label for the app (for example, Atlan). Add an optional description if you like.

  6. Click Save Application, then click Configure Application to open the SAML settings.

  7. In the SAML configuration tab, enter the values you copied from Atlan:

    • IdP Entity ID: paste Atlan's IdP Entity ID.
    • SP Entity ID: paste Atlan's SP Entity ID.
    • ACS URL: paste Atlan's ACS URL.

  8. Under Signature Algorithm, ensure Sign Assertion is enabled.

  9. Under User Attribute Mapping, add the following mappings. For each one, enter the Service Provider Attribute Name on the left and select or type the JumpCloud Attribute Name on the right:

    • email → email
    • firstName → firstname
    • lastName → lastname
    • username → username
    info

    For users provisioned through SSO, the Atlan username comes from this mapping. If no username is mapped, Atlan uses the email prefix by default, which users can change when they first register.

  10. (For group sync) Under Group Attributes, enable include group attribute and set the attribute name to memberOf.

    This is required only if you plan to sync JumpCloud groups to Atlan groups.

  11. Click Save (or Activate).

Download identity provider metadata​

Once the app is configured, export the metadata that Atlan needs:

  1. Open the app in JumpCloud's SSO Applications list.

  2. Open the SSO tab.

  3. Under JumpCloud Metadata, click Export Metadata and save the XML file.

Assign user groups​

Only users in groups assigned to the app in JumpCloud can sign in to Atlan. Still on the app's page in JumpCloud:

  1. Switch to the User Groups tab.

  2. Check the box for each user group you want to give access to Atlan.

  3. Click Save.

Connect JumpCloud to Atlan​

With the app configured in JumpCloud, go back to Atlan to finish. Open your Atlan SSO settings (the Jumpcloud provider you started earlier) and:

  1. Under Identity provider metadata, click Import from XML and select the metadata file you exported from JumpCloud.

  2. Click Save.

Your users can now sign in to Atlan with JumpCloud. By default, they can still sign in with a local Atlan account too: to require JumpCloud, enable Enforce SSO (see below).

Enforce SSO (optional)​

Once JumpCloud SSO works, you can disable local email-and-password sign-in so everyone authenticates through JumpCloud:

  1. In Atlan, go to Settings → SSO and open your Jumpcloud provider.

  2. Enable Enforce SSO.

After enforcing SSO, have your JumpCloud administrator manage access from JumpCloud rather than inviting users directly in Atlan. Assigned users are provisioned automatically on their first sign-in.

Sync JumpCloud groups to Atlan groups (optional)​

Map JumpCloud groups to Atlan groups so users land in the right teams automatically on every sign-in.

Before you start
  • Enable the memberOf group attribute in the JumpCloud SAML app when you configure it. Group sync won't work without it.
  • Create the Atlan groups you want to map to first: you can only map to groups that already exist.

  1. In Atlan, go to Settings → SSO and open your Jumpcloud provider.

  2. Switch to the Groups Mapping tab.

  3. For each Atlan group, under the SSO Groups column, type the name of the matching JumpCloud group (for example, Data Engineering), then click Save on that row.

Group membership syncs every time a user signs in. If you rename a group in JumpCloud, update the mapping in Atlan to match. For sync issues, see Troubleshooting SSO.

info

Once you've configured group mapping, you can add the mapped groups to a persona or purpose to auto-assign permissions as users sign in.

Need help?​

If users can't sign in or aren't landing in the right groups, see Troubleshooting SSO. Contact Atlan Support if the issue persists.

Next steps​

Now that users can sign in through JumpCloud, finish setting up access: