JumpCloud

Configure SURF to authenticate against JumpCloud. This page covers SCIM user and group provisioning, SAML single sign-on, and conditional access based on IP validation.

Before you start

Order matters. If you are configuring both SCIM and SSO, do SCIM first. The SSO section then reuses the same JumpCloud application rather than creating a second one.

Step 1: Set up SCIM provisioning

Provisions users and groups from JumpCloud into SURF.

1.1 Create the JumpCloud application

1. Log in to the JumpCloud Admin Console and navigate to SSO Applications.
2. Click Get Started, select Custom Application, then click Next.
3. Select Export users to this app (Identity Management).
4. Add the label Surf Browser.
5. Select Save Application, then on the next screen select Configure application.
6. Select SCIM 2.0.

1.2 Get the token key from SURF

1. In SURF Admin, navigate to Settings → Additional Setup.
2. Copy the Company Secret.

1.3 Complete the SCIM configuration

1. Back in JumpCloud, enter the following:

1. Select Test connection. If the connection succeeds, save the settings.
2. Enable group management so user groups and memberships are managed in this application.
3. Set the attribute mapping:

1. Select Activate. On successful activation the new users and groups appear in SURF.
2. Select Save.

Step 2: Set up SAML single sign-on

2.1 Create or reuse the application

1. Log in to the JumpCloud Admin Console and navigate to SSO Applications.
2. Click Get Started, select Custom Application, then click Next.
3. Select Manage Single Sign-On (SSO), then choose Configure SSO with SAML.
4. Add the label Surf Browser.
5. Select Save Application, then on the next screen select Configure application.

2.2 Export the JumpCloud metadata

1. Select Export Metadata and keep the file.

2.3 Create the integration in SURF

1. In SURF Admin, navigate to Settings → Integrations.
2. Go to the second page of the integrations list, click the gear beside SAML 2.0 Integration and select Add Integration.
3. Upload the JumpCloud metadata from 2.2. The Entity ID, Single SignOn URL and Public Certificate fields populate from the file.
4. Select Download Metadata to get the SURF metadata, then click Submit.
5. Return to the first page of the integrations list and toggle the new integration ON.

2.4 Complete the configuration in JumpCloud

1. Back in JumpCloud, upload the SURF metadata downloaded in 2.3.
2. Tick Declare Redirect Endpoint.
3. Navigate to User Groups and select the groups that should be assigned to the application.

Step 3: Configure conditional access

Conditional access is enforced by validating the source IP against the SURF infrastructure ranges, so that JumpCloud authentication only succeeds from inside SURF.

3.1 Create the IP list

1. Log in to the JumpCloud Admin Console and navigate to Conditional Lists.
2. Select + to add a new IP list.
3. Name the list Surf.
4. Under IP Addresses, enter the SURF IP ranges supplied by the SURF support team. Enter individual addresses on separate lines. Ranges can be entered with a hyphen or in CIDR notation.
5. Click Save.

3.2 Create the conditional policy

1. Navigate to Conditional Policies.
2. Under Zero Trust Policies → Network Trust, select Guided Setup and choose User Portal as the resource.
3. Give the policy a name and select the group it should apply to.
4. Add a condition:

1. Under Action → Access, select Denied.
2. Select Create policy.

The effect is that any user in the selected group attempting to authenticate from an IP outside the SURF list is denied.

Reference

Menu paths

Troubleshooting

For anything not covered here, contact the SURF support team.