JumpCloud

Trustle reads users, user groups and their members, the SSO apps each user can open, and sign-in activity from JumpCloud. Trustle can create, suspend, and delete users, add and remove group members, and remove a user’s access to an SSO app.

Prerequisites

• A JumpCloud account with the Administrator role. Only an administrator can create custom roles and service accounts.
• Directory Insights on your JumpCloud plan, if you want last-used dates. Without it, the dates stay empty.
• A JumpCloud organization in the US region. Trustle calls the US addresses of the JumpCloud API for every connection. Contact Trustle support before you connect an organization in another region.

Configure JumpCloud

Step 1: Create a custom role

1. Sign in to the JumpCloud Admin Portal as an administrator.

2. In the left menu, go to Settings.

3. Select the Administrators tab. Then select the Custom Roles tab.

4. Click Add Custom Role.

   

5. Enter a name, for example trustle-sa.

6. In the template role, select Read Only. This template gives read access to the rest of JumpCloud, which includes SSO applications and Directory Insights.

Step 2: Grant permissions

1. Give Full Access to the Groups Management category.

   

2. Give Full Access to the User Management category.

   

3. Save the role.

The role gives Trustle these permissions:

Permission	Required	What Trustle does with it
User Management: Full Access	Yes	Imports users. Creates, suspends, and deletes users. Test Connection checks read access to users.
Groups Management: Full Access	Yes	Imports user groups and their members. Adds and removes group members.
Read access to SSO applications, from the Read Only template	Optional	Lists the SSO apps each user can open, and removes that access. Without it, Trustle shows no SSO apps for JumpCloud.
Read access to Directory Insights, from the Read Only template	Optional	Shows the date each user last signed in, and the date each user last opened each SSO app. Needs Directory Insights on your plan. Without it, the dates stay empty.

Step 3: Create a service account

1. In the left menu, go to Settings.

2. Select the Service Account tab. Click New.

   

3. Enter a name, for example Trustle.

4. Select the custom role from Step 1.

   

5. Click Configure.

6. Select the secret lifetime. Then activate the secret.

   

7. Copy the Client ID and the Client Secret.

   

Caution

JumpCloud shows the client secret once. If you lose it, create a new secret.

Step 4: Collect the values for Trustle

1. In the left menu, go to Settings. Select Organization Profile.

2. Under General, copy the Organization ID.

   

Trustle field	Where to find it in JumpCloud	Example
Organization ID	Settings → Organization Profile → General	<organization-id>
Client ID	The service account from Step 3	<client-id>
Client Secret	The service account from Step 3	<client-secret>

Connect in Trustle

1. In Trustle, go to Connections.

2. Under Identity Providers, find JumpCloud and click Connect.

3. Enter a Connection Name, for example JumpCloud production. Description is optional.

4. Enter the values from Step 4.

5. Select Use as Identity Provider if JumpCloud is the source of your users. Trustle allows one identity provider at a time. You cannot change this setting after you save.

   Use as Identity Provider	What happens
   Selected	Trustle creates a Trustle user for each JumpCloud user. Trustle shows SaaS Applications and the other connection sections. You can turn on sign-in with JumpCloud.
   Cleared	Trustle imports JumpCloud accounts but creates no Trustle users. If no other connection is the identity provider, Trustle keeps SaaS Applications hidden. Sign-in with JumpCloud is not available.

6. Click Test Connection.

7. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in and read one user. It does not check every permission. Do the steps in Verify after the first sync.

Optional: Turn on sign-in with JumpCloud

Users can sign in to Trustle with their JumpCloud account. This is a setting on the JumpCloud connection, not a separate connection.

Caution

When you turn on sign-in with JumpCloud, Trustle requires it for every user in your organization. Password sign-in and other sign-in methods stop working at the next sign-in. Before you start, check these items:

• The JumpCloud connection has Use as Identity Provider selected. Without it, the SSO tab does not show.
• Each person who signs in exists in JumpCloud, and the first sync imported them. Trustle refuses sign-in for a person it did not import.
• You link your own account in step 7 of “In Trustle” below, before you sign out.

In JumpCloud: create an OIDC app

1. In the JumpCloud Admin Portal, go to Access → SSO Applications.

2. Create a new application. Select Custom Application.

3. Select Manage Single Sign-On. Then select Configure SSO with OIDC.

4. Enter a display name, for example Trustle SSO. Confirm the review.

5. On the Configuration Settings page, set these values:

   JumpCloud field	Value
   Redirect URI	https://console.trustle.io/__/auth/handler
   Client Authentication Type	Client Secret Basic
   Login URL	https://console.trustle.io/auth/login

6. On the Attribute Mapping page, set Standard Scopes to Email and Profile. Without the email scope, sign-in fails.

7. Give the people who sign in to Trustle access to the app. In JumpCloud, bind their user groups to the app.

8. Activate the application.

9. Copy the Client ID and the Client Secret of the app. They are not the values of the service account from Step 3.

In Trustle: enable SSO

1. In Trustle, go to Connections and open the JumpCloud connection.

2. Select the Settings tab, then the SSO tab.

3. Click Enable SSO.

4. Enter the values from the OIDC app:

   Trustle field	Value
   OIDC Client ID	The app’s Client ID
   OIDC Client Secret	The app’s Client Secret
   Issuer URL	https://oauth.id.jumpcloud.com. It is the same for every JumpCloud organization.

5. Click Enable SSO.

6. The SSO tab shows SSO Status Enabled, and a Link your account message. To change these values later, edit them on the same tab and click Save Configuration.

7. Click Link account. Sign in with your JumpCloud account when JumpCloud asks.

Verify

1. On the Connections page, open the JumpCloud connection.
2. Wait for the first sync to finish.
3. Check that the user count and the group count match JumpCloud.
4. If you set managers in JumpCloud, check that users show a manager.
5. If you turned on sign-in with JumpCloud, open a private browser window. Sign in to Trustle as a JumpCloud user who is not an admin.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a dedicated service account and custom role for Trustle only.
• Grant only the permissions for the features you use.
• Store the client secrets in a secret manager. Never commit them to a repository.
• Rotate the service account secret before its lifetime ends. Then paste the new secret into the Trustle connection.
• When Trustle removes a user’s access to an SSO app that a group grants, Trustle removes the user from that group. The user also loses everything else that group grants.

Troubleshooting

Test Connection fails

Trustle does not show the reason yet. Check these values:

• Client ID and Client Secret: copy them again from the service account. The secret must still be active.
• Organization ID: it must be the organization of the service account. Copy it again from Organization Profile.
• Role: the service account’s role must have read access to users. The Read Only template gives it.
• Region: an organization outside the US region fails. Contact Trustle support.

Test Connection passes, but users show no Trustle accounts

The connection is not the identity provider. Trustle creates Trustle users only from the identity provider connection. To change it, disconnect JumpCloud and connect it again with Use as Identity Provider selected.

SSO apps or last-used dates are missing

• SSO apps: the role needs read access to SSO applications. Use the Read Only template from Step 1.
• Last-used dates: your JumpCloud plan needs Directory Insights, and the role needs read access to it.

Trustle shows the data after the next sync.

Managers are missing

Trustle reads the manager from the JumpCloud Manager field. If that field is empty, Trustle reads a custom attribute named managerEmail, managersEmail, managerMail, or manager. The custom attribute must hold one email address. Case and spaces in the attribute name do not matter.

The SSO tab does not show

The JumpCloud connection is not the identity provider. Only a connection with Use as Identity Provider selected shows the SSO tab.

Enable SSO fails

• Issuer URL: it must start with https://. Use https://oauth.id.jumpcloud.com.
• OIDC Client ID and OIDC Client Secret: use the values of the OIDC app, not the values of the service account.

Users cannot sign in after you turn on SSO

• “This organization requires SSO authentication”: the user signed in with a password or another method. Sign in with JumpCloud.
• “Your organization has not added your account to Trustle yet”: Trustle did not import this person. Check that the person exists in JumpCloud. Then wait for the next sync.
• JumpCloud refuses the sign-in: check that the person’s user group is bound to the OIDC app. Check that Client Authentication Type is Client Secret Basic and that Standard Scopes includes Email.

To stop requiring sign-in with JumpCloud, open the SSO tab and click Disable SSO.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the JumpCloud Org ID. Never send a secret, key, or token.