Files.com supports Single Sign-On (SSO) integration with JumpCloud via the SAML protocol. Users log in with their JumpCloud credentials without a separate Files.com username or password, using a Service Provider (SP)-initiated SSO flow. JumpCloud acts as the Identity Provider (IdP), so identity management and access control stay centralized in JumpCloud.

For user and group provisioning, see Provisioning Users Automatically.

Adding Files.com in JumpCloud

After logging in to your JumpCloud account as an administrator, navigate to SSO Applications -> Add New Application, and search for Custom Application. Select it to configure Files.com as a custom SAML application.

In the Create New Application Integration wizard, select all features to be enabled by choosing the Configure SSO with SAML option under Manage Single Sign-On, enter the Display Label as desired, and save the application.

Configure the application using the SAML configuration settings below, leaving the remaining fields at their default values.

Parameter	Value
IdP Entity ID	`https://app.files.com/saml/metadata`
SP Entity ID (Audience)	`https://app.files.com/saml/metadata`
ACS (Consumer) URL	`https://app.files.com/saml/consume`
SAMLSubject NameID	email
SAMLSubject NameID Format	email address
Default Relay State (optional)	`[SUBDOMAIN].files.com`
Login URL (optional)	`[SUBDOMAIN].files.com`

Replace [SUBDOMAIN] with your specific Files.com subdomain. The SAMLSubject NameID is the user identifier JumpCloud sends in the SAML response. Files.com uses this value as the Files.com username. See How Files.com Matches JumpCloud Users for details.

Adding JumpCloud in Files.com

Enter the Display Name and choose a connection method.

There are three ways to connect to JumpCloud. The right choice depends on your organization's security and compliance requirements.

Metadata URL is the simplest option, because it automatically handles updates such as certificate renewals or changes to service provider URLs. For example, if JumpCloud's certificate expires, the Metadata URL updates automatically, while Metadata XML and Certificate Fingerprint require manual updates. If automatic updates are not required, Metadata XML works well but requires manual intervention when JumpCloud changes. Certificate Fingerprint is the most manual option, giving you the most control over updates and requiring the most effort to maintain.

Using Metadata URL

Paste the Metadata URL you copied from JumpCloud into the Metadata URL field.

Using Metadata XML File

To use a metadata XML file, export the metadata from the SSO page in JumpCloud as a JumpCloud administrator. In Files.com, select the Metadata XML file option and upload the XML file you exported.

Using Certificate Fingerprint

To use Certificate Fingerprint, download the IdP Certificate from the JumpCloud application dashboard. With the certificate on your local machine, run the following command in a terminal to obtain the certificate's fingerprint.

openssl x509 -in [your_cert_file] -noout -sha256 -fingerprint

In Files.com, select the Certificate Fingerprint option and paste the fingerprint you obtained from the above command. Also paste the IdP URL you copied from JumpCloud. The same URL can be used for both the SLO endpoint and the SSO endpoint.

Assigning Users

After you save the changes, the JumpCloud Single Sign-On method is available when assigning an authentication method for a user in Files.com, and the Sign in with JumpCloud button appears on your site's login page.

Keep at least one site administrator on the password authentication method rather than assigning every administrator to SSO. This prevents being locked out of Files.com if there's an IdP or SSO issue.

How Files.com Matches JumpCloud Users

Files.com matches JumpCloud users by the Files.com username field. For SAML login to succeed, the value JumpCloud sends in the SAML response must match an existing Files.com username.

The SAMLSubject NameID field controls what JumpCloud sends as the SAML identifier. The configuration above sets it to email, so JumpCloud sends the user's email address as the NameID. Files.com uses that value as the Files.com username to find the matching account. Each Files.com user must have a username that exactly matches their email address in JumpCloud.

JumpCloud user profiles have two separate, required fields: Username and Company Email. They can carry different values. JumpCloud lets you change the SAMLSubject NameID to username or any other user attribute. If you change it away from email, Files.com uses the new value as the Files.com username, and all affected users must have usernames that match the new identifier.

When SCIM provisioning is also enabled, the SAMLSubject NameID and the SCIM userName must resolve to the same Files.com username. JumpCloud's SCIM integration uses the user's email address as the userName by default. If the SAMLSubject NameID is set to email, SAML and SCIM both resolve to the email address and they align. If you change the SAMLSubject NameID to username, SAML sends the JumpCloud username while SCIM continues sending email, creating a duplicate account for each user.

JumpCloud SSO