Skip to content
downpipes docs

Sign in to downpipes with JumpCloud

downpipes signs people in to the console against JumpCloud over OpenID Connect. The preset targets the US region issuer; EU and IN tenants have a different issuer host and use the Generic OIDC preset instead, pointed at their regional discovery URL. The shared add-a-connection mechanics and the pre-save test live on Connect OIDC or OAuth2. Other identity providers, along with monitoring and ticketing tools, are listed in the full integration catalogue on the website.

What you need

  • A JumpCloud Admin Portal account that can create an SSO application.
  • Owner access to the downpipes console, since connection management is owner-only and asks for a step-up sign-in.

Set it up

  1. Sign in to the JumpCloud Admin Portal and open SSO Applications under Access, then Add New Application, and choose the Custom Application tile.
  2. Select Manage Single Sign-On (SSO), then Configure SSO with OIDC.
  3. Set a Display Label (for example “downpipes”) and, under Redirect URIs, add your downpipes callback URL, which is your console origin followed by /admin/oidc/callback/<connId>, for example https://console.example.com/admin/oidc/callback/jumpcloud.
  4. Set Client Authentication Type to Client Secret POST and activate the application.
  5. In the one-time confirmation window, copy the Client ID and Client Secret, since they are shown only once.
  6. Open the application’s User Groups tab and assign the groups whose members may sign in.
  7. In the downpipes console, open the external identity providers screen (/access/idp), choose the JumpCloud tile and Add a connection. This is owner-only and asks for a step-up sign-in.
  8. Paste the client id and secret, run Test connection, then Add the connection.

Group-to-role mapping

JumpCloud carries group membership in a memberOf attribute, which is an attribute mapping rather than a scope. In the application’s SSO settings, under Attributes, tick include group attribute and set the Groups Attribute Name to memberOf. Only groups assigned to the application (the User Groups tab) appear in memberOf, so assign each group you want to map. Then map a JumpCloud group onto a downpipes role on Group-to-role mapping. A person in one group receives memberOf as a bare string and a person in several receives an array; downpipes handles both, so a single-group member is never silently dropped.

Good to know

  • memberOf is an attribute, not a scope. Adding a groups scope does nothing; the group attribute mapping is what carries membership.
  • The preset is the US region. EU or IN tenants have a different issuer host, so connect those with the Generic OIDC preset pointed at your regional .well-known URL.
  • JumpCloud uses one shared issuer for every tenant, so the issuer alone does not identify your organisation; trust rests on your client id and the per-connection subject prefix.
  • Set the connection’s subject prefix to a value that identifies your organisation, since the shared issuer does not.

Last updated .