Connect JumpCloud

Setting up SAML sign-in with your JumpCloud directory, what changes the moment you save, and what isn't available yet.

For directors and administrators · SAML 2.0

What this does

Staff sign in to RoundUp with their JumpCloud account, so the MFA and access rules you set in JumpCloud apply to RoundUp too.

• Passwords stop working for staff, yours included. Once a certificate is saved, RoundUp refuses a password for every staff account at your center. Families keep theirs. If a password still worked, turning someone off in JumpCloud wouldn't keep them out.
• Accounts still come from invitations. Signing in never creates one. RoundUp matches the email JumpCloud sends to a staff member invited to your center — they don't need to have opened the invitation first; their first JumpCloud sign-in activates the account.
• Roles stay in RoundUp. Nothing JumpCloud sends changes what someone can see. See Roles and permissions.
• One sign-in provider per center. If another provider is connected, the JumpCloud tile says so. Disconnect that one first.

Before you start

• You're a director, assistant director or admin in RoundUp, and you can add applications in the JumpCloud Admin Portal.
• Each staff member's email in JumpCloud is the address their RoundUp invitation went to. Check your own first.
• It's outside drop-off and pick-up, and you have a second phone or tablet to test on.

Copy RoundUp's values

Open More → Marketplace, find JumpCloud and tap Connect. The card 1. Paste these into JumpCloud lists the SP metadata URL, ACS URL, SP Entity ID and Center ID. Tap to copy each from your own screen — they contain your center's ID:

Set up the app in JumpCloud

1. Add a custom SAML application In the JumpCloud Admin Portal, open SSO Applications, add a new application and choose a custom SAML app.
2. Give it RoundUp's details Better than typing the SP Entity ID and ACS URL: open the SP metadata URL in a browser, save the file, and upload it with JumpCloud's Upload Metadata. That avoids the typo that fails every sign-in at the last step.
3. Send the email address Leave SAMLSubject NameID as email, with the format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. RoundUp identifies staff by email, so a username matches nobody.
4. Sign both parts Set Sign to Assertion and Response. JumpCloud's default signs only the response, and RoundUp refuses a sign-in unless both are signed.
5. Give staff access Assign the application to the user group that holds your staff, and make sure that includes you.
6. Collect three things Once it's saved, download the IdP certificate, and copy the IdP URL (https://sso.jumpcloud.com/saml2/…) and the IdP Entity ID.

Finish in RoundUp

Under 2. Paste these from JumpCloud:

• Signing certificate — the whole certificate, with or without the -----BEGIN CERTIFICATE----- lines.
• IdP SSO URL — JumpCloud's IdP URL. The screen calls it optional, but treat it as required: without it the Sign in with JumpCloud button has nowhere to send staff, and passwords won't work either.
• IdP Entity ID — optional. If you fill it in, it must match JumpCloud's exactly.

Tap Save. The top card should say Connected, with Staff can sign in with JumpCloud from the app or from their JumpCloud console. underneath.

What staff do

Staff enter their email and tap Continue. RoundUp shows This center signs in with JumpCloud. and a Sign in with JumpCloud button. They can also start from the JumpCloud User Portal on the phone or tablet RoundUp is installed on — on a computer, that can't open the app. Someone newly invited accepts their invitation from the email first.

Provisioning (optional)

The JumpCloud screen also has a Provisioning (optional) section with Show provisioning details. It shows a SCIM base URL and a bearer token to paste into the RoundUp app's Identity Management tab in JumpCloud. With it turned on:

• Adding someone to the app's group creates their staff account at your center and sends them the invitation. Everyone arrives as a teacher — JumpCloud can't send a role — so promote them in RoundUp.
• Removing or deactivating them takes them off your staff and signs out any session they have open within about a minute, including on a shared tablet. That is the whole of offboarding for a provisioned person.
• Name changes aren't copied. Once an account exists, edit the name in RoundUp if it changes in JumpCloud.

Without provisioning, invite staff from More → Settings → User Management, and when someone leaves, turn them off in JumpCloud and email support@roundupece.com to end their access. See What happens when someone leaves, and the SCIM provisioning reference for the protocol details.

Certificates and disconnecting

JumpCloud's certificate has an expiry date, and once JumpCloud signs with a different one, every staff sign-in fails, yours included. Put the date in your diary. When you replace it, paste the new one into Signing certificate (stored — paste to replace), tap Save the same day, and test on a second device.

If you miss it, how you get back in depends on what happened. If the certificate RoundUp holds has expired, RoundUp stops treating JumpCloud as usable and your staff can sign in with their passwords again until you paste the new one — nothing to ask for. If JumpCloud rotated to a new certificate before the old one expired, the old one still looks valid from our side, so email support@roundupece.com: we'll re-enable passwords at your center for a few hours so you can sign in and paste the new certificate. That window ends by itself.

Disconnect JumpCloud ends JumpCloud sign-in and lets staff use their RoundUp passwords again. Staff accounts and their history aren't touched.

Troubleshooting

"The JumpCloud SAML assertion could not be verified."

Check that Sign is Assertion and Response, that RoundUp holds the certificate JumpCloud uses now, and that the SP Entity ID and any IdP Entity ID match exactly on both sides.

"This center hasn't finished connecting JumpCloud yet."

The IdP SSO URL is empty. Add it and tap Save.

"No account is linked to your JumpCloud email. Ask your director to invite you first."

RoundUp has no staff account under the address JumpCloud sent. (An invitation that hasn't been opened isn't the cause — that account signs in and is activated.) Compare the two addresses character by character — it's nearly always the email.

"JumpCloud didn't provide an email to sign in with."

The NameID is something other than an email address, such as a username. Set SAMLSubject NameID back to email.

"Your JumpCloud account isn't linked to a staff account at this center. Contact your director."

The address belongs to a RoundUp account, but not to staff at this center. Check they were invited here.

"This center signs in with its identity provider. Use the sign-in button on the login screen."

Someone tried a password. Once JumpCloud is connected, staff tap Sign in with JumpCloud instead.

The whole center is being asked for a password again

That's RoundUp telling you the certificate it holds has expired. Staff can keep working on their passwords meanwhile. Paste JumpCloud's current certificate and tap Save, and the JumpCloud button comes back.

More: All director guides