## Enable JumpCloud for SSO

URL: https://docs.atlan.com/product/integrations/identity-management/sso/how-tos/enable-jumpcloud-for-sso

> Configure SAML 2.0 single sign-on between JumpCloud and Atlan so your users sign in to Atlan with their JumpCloud credentials. Exchange service provider and identity provider metadata, assign user groups in JumpCloud, and optionally sync JumpCloud groups to Atlan.

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing JumpCloud credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new SAML app in JumpCloud, then import JumpCloud's identity provider metadata back into Atlan.

Start in Atlan, build and configure the app in JumpCloud, then return to Atlan to finish. Group sync is optional and covered at the end.

## Prerequisites

Before you begin, make sure you have:

- **Admin access in Atlan.** Only admins can configure SSO.
- **Administrator access in JumpCloud** so you can create a SAML application and assign user groups.
- A decision on the **default role** new users receive on first sign-in (Admin, Member, or Guest). Set it in [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt). Most workspaces use Member.

## Get Atlan's service provider details

Before setting up the app in JumpCloud, get the values Atlan provides.

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **SSO**.

3. Click **New**, then select **Jumpcloud** as the provider.

4. Under _Service provider metadata_, copy all three values: you'll paste them into JumpCloud in the next step:

 - **IdP Entity ID**
 - **SP Entity ID**
 - **ACS URL**

Keep this tab open. You'll return here to finish setup.

## Configure in JumpCloud

All the app setup happens in the JumpCloud console: create the application, configure SAML fields and attribute mappings, collect the IdP metadata, and assign user groups.

### Create SAML application

In the [JumpCloud console](https://console.jumpcloud.com):

1. In the left menu, click **Access Management** (or **Access**), then click **SSO Applications**.

2. Click **+ Add New Application**.

3. Click **Custom Application**, then click **Next**.

4. Select **Manage Single Sign-On (SSO)**, then select the **Configure SSO with SAML** radio button and click **Next**.

5. Under _General Info_, enter a **Display Label** for the app (for example, `Atlan`). Add an optional description if you like.

6. Click **Save Application**, then click **Configure Application** to open the SAML settings.

7. In the SAML configuration tab, enter the values you copied from Atlan:

 - **IdP Entity ID**: paste Atlan's _IdP Entity ID_.
 - **SP Entity ID**: paste Atlan's _SP Entity ID_.
 - **ACS URL**: paste Atlan's _ACS URL_.

8. Under _Signature Algorithm_, ensure **Sign Assertion** is enabled.

9. Under _User Attribute Mapping_, add the following mappings. For each one, enter the **Service Provider Attribute Name** on the left and select or type the **JumpCloud Attribute Name** on the right:

 - `email` → `email`
 - `firstName` → `firstname`
 - `lastName` → `lastname`
 - `username` → `username`

 :::info
 For users provisioned through SSO, the Atlan username comes from this mapping. If no username is mapped, Atlan uses the email prefix by default, which users can change when they first register.
 :::

10. (For group sync) Under _Group Attributes_, enable **include group attribute** and set the attribute name to `memberOf`.

 This is required only if you plan to [sync JumpCloud groups to Atlan groups](#sync-jumpcloud-groups-to-atlan-groups).

11. Click **Save** (or **Activate**).

### Download identity provider metadata

Once the app is configured, export the metadata that Atlan needs:

1. Open the app in JumpCloud's SSO Applications list.

2. Open the **SSO** tab.

3. Under _JumpCloud Metadata_, click **Export Metadata** and save the XML file.

### Assign user groups

Only users in groups assigned to the app in JumpCloud can sign in to Atlan. Still on the app's page in JumpCloud:

1. Switch to the **User Groups** tab.

2. Check the box for each user group you want to give access to Atlan.

3. Click **Save**.

## Connect JumpCloud to Atlan

With the app configured in JumpCloud, go back to Atlan to finish. Open your Atlan SSO settings (the **Jumpcloud** provider you started earlier) and:

1. Under _Identity provider metadata_, click **Import from XML** and select the metadata file you exported from JumpCloud.

2. Click **Save**.

Your users can now sign in to Atlan with JumpCloud. By default, they can still sign in with a local Atlan account too: to require JumpCloud, enable **Enforce SSO** (see below).

## Enforce SSO (optional)

Once JumpCloud SSO works, you can disable local email-and-password sign-in so everyone authenticates through JumpCloud:

1. In Atlan, go to **Settings → SSO** and open your Jumpcloud provider.

2. Enable **Enforce SSO**.

After enforcing SSO, have your JumpCloud administrator manage access from JumpCloud rather than [inviting users directly in Atlan](https://docs.atlan.com/llms/governance/access-control/invite-new-users/llms.txt). Assigned users are provisioned automatically on their first sign-in.

## Sync JumpCloud groups to Atlan groups (optional) {#sync-jumpcloud-groups-to-atlan-groups}

Map JumpCloud groups to Atlan groups so users land in the right teams automatically on every sign-in.

:::warning Before you start
- Enable the `memberOf` group attribute in the JumpCloud SAML app when you configure it. Group sync won't work without it.
- [Create the Atlan groups](https://docs.atlan.com/llms/governance/access-control/manage-groups/llms.txt) you want to map to first: you can only map to groups that already exist.
:::

1. In Atlan, go to **Settings → SSO** and open your Jumpcloud provider.

2. Switch to the **Groups Mapping** tab.

3. For each Atlan group, under the _SSO Groups_ column, type the name of the matching JumpCloud group (for example, `Data Engineering`), then click **Save** on that row.

Group membership syncs every time a user signs in. If you rename a group in JumpCloud, update the mapping in Atlan to match. For sync issues, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt).

:::info
Once you've configured group mapping, you can add the mapped groups to a [persona](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt) or [purpose](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt) to auto-assign permissions as users sign in.
:::

## Need help?

If users can't sign in or aren't landing in the right groups, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt). Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## Next steps

Now that users can sign in through JumpCloud, finish setting up access:

- [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Choose whether new users land as Member, Guest, or Admin.
- [Restrict auto user creation](https://docs.atlan.com/llms/governance/access-control/limit-sso-automatically-creating-users-when-they-log-in/llms.txt): Limit sign-in to only the users your identity provider assigns.
- [Configure SCIM provisioning](https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/configure-scim-provisioning): Automate the full user lifecycle (optional).

---