Connect JumpCloud so your directory users sign in to ReFresh with their JumpCloud accounts. JumpCloud supports both OpenID Connect (OIDC) and SAML; use OIDC unless you have a reason not to.

Before you start:

In the wizard, select JumpCloud and your protocol (OpenID Connect recommended).

On the wizard's Add ReFresh to your IdP step, copy the Redirect URI (https://auth.refresh.tech/oauth2/callback), the Scopes (openid, profile, email), and the Required claims (email, given_name, family_name, groups).

ReFresh, the "Add to IdP" step for JumpCloud (OIDC): Redirect URI, scopes, and required claims.

In the JumpCloud Admin Portal, go to SSO Applications → Add New Application.

JumpCloud: SSO Applications, then Add New Application.

Choose a Custom Application.

JumpCloud: create a Custom Application.

Select Configure SSO with OIDC.

JumpCloud: choose OIDC as the SSO option.

Enter the general info (Display Label "ReFresh") and review.

JumpCloud: general info (Display Label).

JumpCloud: review, SSO with OIDC.

In the SSO config, set the Redirect URI to the ReFresh Redirect URI (https://auth.refresh.tech/oauth2/callback), then set the Login URL to the ReFresh Login URL (https://app.refresh.tech/auth/login). Ensure that the Client Authentication Type is set to Client Secret Basic.

JumpCloud: paste the ReFresh Redirect URI.

After activating, copy the Client ID and Client Secret.

JumpCloud, "Application Activated": copy the Client ID and Client Secret.

On the Paste IdP details step, choose your JumpCloud Region (United States / Europe / India / Custom), and enter the Client ID and Client Secret. Under Advanced, set the Groups Claim to memberOf (see roles below).

ReFresh: Region, Client ID/Secret, and Groups Claim memberOf.

Then set roles, test, and activate per the hub.

JumpCloud needs a two-part setup: hold the role value on the group, then emit it under the name ReFresh reads. Pick the path by how many roles a user needs (see Setting up and managing SSO (Roles for SSO users)).

On the user group's Custom Attributes, add a String attribute refresh_role = the ReFresh slug (e.g. admin). Every member of the group carries it.

JumpCloud: group custom attribute refresh_role = the ReFresh slug.

Then on the SSO app's Attributes, map the Service-Provider attribute roles from the JumpCloud attribute refresh_role. In ReFresh choose Automatic and set the role-claim attribute to roles.

JumpCloud: map roles ← refresh_role, and tick Include Group Attribute (memberOf).

A custom attribute holds only one value: If a user is in two groups that both set refresh_role, one value overwrites the other; the user gets a single role. For multiple roles, use the groups path below.

Tick Include Group Attribute and set the Groups Attribute Name to memberOf (JumpCloud's default). In ReFresh use Manual (group mappings) and map each group value to a role.

JumpCloud: the user group whose membership is emitted as memberOf.

JumpCloud: bind the user group to the app (User Groups tab).

Match the group attribute name on both sides: JumpCloud emits groups under memberOf, but ReFresh's manual mappings default to groups. Set ReFresh's Groups Claim / Claim Path to memberOf (as in the paste-details step above) so they match; otherwise nothing maps (a silent no-match).

If you must use SAML, choose SAML in the wizard. ReFresh gives you an ACS URL (https://auth.refresh.tech/samlv2/acs), an SP Entity ID (https://auth.refresh.tech/samlv2/sp/<connection-id>), and SP metadata; JumpCloud gives you its IdP metadata.

Create the app the same way, choosing Configure SSO with SAML.

JumpCloud: choose SAML as the SSO option.

ReFresh, the "Add to IdP" SAML step for JumpCloud: SP Entity ID, ACS URL, NameID, and Download SP Metadata.

JumpCloud, SAML SSO config: paste ReFresh's SP Entity ID and ACS URL.

Export JumpCloud's metadata to give to ReFresh, and add the group/role attribute statements (roles ← refresh_role, plus memberOf for group mappings).

JumpCloud: SAML attribute statements (roles ← refresh_role, group memberOf).

JumpCloud: export / copy the SAML metadata URL.

Bind the user group to the SAML app on its User Groups tab.

JumpCloud: bind the ReFresh user group to the SAML app (User Groups tab).

Paste that metadata into ReFresh's Paste IdP details step.

ReFresh: paste JumpCloud's SAML metadata, Groups Attribute memberOf.

Then set roles, test, and activate per the hub.