Using JumpCloud as your Identity Provider (IdP)

This guide will walk you through the steps to set up Single Sign-On (SSO) with SAML 2 authentication in Mambu, using JumpCloud as your Identity Provider (IdP).

Prerequisites

• Administrator access to both Mambu and JumpCloud
• Understanding of SAML 2.0 concepts
• Roles Defined In Mambu
• JumpCloud Groups Defined
• Custom Attribute defined for groups to map RoleID

Step 1: Configure JumpCloud as the IdP

1. Log in to the JumpCloud Admin Portal.
2. Navigate to User Authentication > SSO Applications.
3. Click + Add New Application.
4. Enter the name of the application in the Search field (e.g. Mambu) and select it.
5. Click Next.
   1. In the Display Label, type your name for the application.
      • Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or show the application in the User Portal. (e.g., "Mambu Sandbox/Prod SSO").
   2. In the IdP Entity ID field, enter a unique identifier for JumpCloud (e.g., jumpcloud-mambu-sso).
   3. In the SP Entity ID field, you'll need to enter Mambu's SAML URL depending which one you are setting up:
      • Production: https://<tenant>.mambu.com/saml/login
      • Sandbox: https://<tenant>.sandbox.mambu.com/saml/login
6. Click Save Application.
7. Click Configure Application.
8. Select the SSO tab.
9. Configure the ACS URL (Assertion Consumer Service URL):
   - Production: https://<tenant>.mambu.com/saml/login
   - Sandbox: https://<tenant>.sandbox.mambu.com/saml/login
10. Save the IdP URL; you will need this for the Mambu configuration.
    • Ensure the Attributes are mapped. These are case sensitive.
    • RoleID represents the Role Name in Mambu. If your user groups match the RoleName of Mambu, in the User Attributes you can set RoleID to the JumpCloud user attribute memberOf. For more information see this page.
    • Alternatively, you could add a custom attribute in each user group with the value of the Role Name in Mambu.
    • Using the custom attribute your SSO Attributes should look like this:
11. Save the configuration.
12. Download the IdP Certificate from JumpCloud. You will need this for the Mambu configuration.

Step 2: Configure Mambu as the Service Provider (SP)

1. Log in to your Mambu instance with administrator privileges.
2. Navigate to Administration > Access > Federated Authentication.
3. Select the option to Enable SSO authentication.
4. Enter a Display Name (e.g., "JumpCloud SSO")
5. In the Single Sign-On Endpoint, enter the following URL with the application name you specified in Step 1.4: https://sso.jumpcloud.com/saml2/\<applicationname\>.
6. Obtain the fingerprint of the identity provider (IdP) certificate, which is required by Mambu.
   • Run the following command in a terminal and replace <filelocation>/certificate.pem with your certificate's location and name downloaded from step 1.15:
   • openssl x509 -sha256 -in /\<filelocation\>/certificate.pem -noout -fingerprint
   • Enter the value in the Certificate Fingerprint field.
7. In the Issuer ID field enter the value of the IdP Entity ID specified in Step 1.5.b.
8. In the ACS URL field, enter the Mambu tenant URL used in Step 1.5.c:
   • Production: https://<tenant>.mambu.com/saml/login
   • Sandbox: https://<tenant>.sandbox.mambu.com/saml/login
9. Click Test Configuration.
   • This will validate communication back to JumpCloud and validate the certificate and URLs.
10. If successful, click Save.
    • Although you may get a message that this is irreversible, you can still disable Federated Authentication in Mambu if needed.

Step 3: Assign users to branches

To assign users to specific branches using Federated Authentication, branch assignment must be done through the IdP. This requires attribute mapping. Add the user attribute BranchID to JumpCloud's SAML configuration. The value at user or group level must match the ID for the branch defined in Mambu.

For more information, please refer to the supporting documentation.

Step 4: Test the SSO connection

1. In another browser or using incognito mode, open the Mambu URL and click the Login with JumpCloud SSO link below the password field to initiate a test SSO login.
2. You will be redirected to JumpCloud for authentication.
3. After being successfully authenticated in JumpCloud, you will be redirected back to Mambu and logged in.
4. Verify that user access and roles are correctly mapped at the Administration > Access > Users view.

Step 5: Optional Single Log Out (SLO)

Some IdPs support Single Log Out functionality where, when a user logs out of one system, the IDP logs them out of all integrated systems. At the time of this writing JumpCloud did not support SLO.

Please check with JumpCloud support if Single Log Out is supported.

For more information on SLO from Mambu, refer to the support documentation.

Troubleshooting