Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
JumpCloud creates, updates and deactivates people in Living Security through SCIM. This guide connects a JumpCloud custom SCIM application to Living Security and tests it with one person.
Living Security has not certified JumpCloud in a live run. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644). Its tests replay the requests JumpCloud sends: a create that carries a password (Living Security discards it), full PUT updates, and group membership sent as the complete list. The JumpCloud menu names below come from JumpCloud documentation and can differ in your version. Check each step with the setup checklist and the Attributes tab.

What you need

  • A Living Security admin with permission to manage SSO and SCIM settings.
  • An administrator of JumpCloud, or a setup link you send to one.
  • SSO is not required. If you use SSO, the SCIM userName must be the same value your SSO sends as the NameID: the person’s email address. See SSO and sub-organizations.

Set up provisioning

1

Create the SCIM token in Living Security

On the SCIM card, select Set up SCIM. Copy the SCIM base URL and the Bearer token. You can’t see the token again. See Set up a SCIM connection.
2

Create the application in JumpCloud

In the JumpCloud Admin Portal, open SSO Applications, add a Custom Application, and turn on Manage Single Sign-On (SSO) and Identity Management (SCIM). Name it Living Security and save it. The Identity Management settings appear after you save.You can use an application you already have for Living Security SSO.
3

Enter the connection

On the Identity Management tab:
  1. Choose SCIM 2.0.
  2. Paste the SCIM base URL into Base URL.
  3. Paste the token into Token Key, and choose Bearer Token as the token type.
  4. Enter a Test User Email that does not exist in Living Security yet.
  5. Select Test Connection, then Activate.
The Living Security Checklist shows First request received and Connection test passed.
The connection test creates the test user and then deletes it. The test person then stays in Workforce → People as deactivated. Turn off Send welcome email when SCIM provisions a new user first if that address should not get a welcome email.To replace the token later, enter the new token and select Update. Save alone does not change the token.
4

Check the attributes

JumpCloud sends its standard user attributes. Check that each person has:
  • An email. JumpCloud sends it as userName and as the work email. When the email changes, the userName changes too.
  • First name, last name, job title and department, if you want them in Living Security.
JumpCloud sends every user update as a PUT, which replaces the whole user. An attribute that is not in the request is cleared in Living Security.
5

Choose who to provision

On the application’s User Groups tab, bind one group that holds only your test person. JumpCloud provisions the members of the bound groups, and sends those groups to Living Security.

Test your setup

Follow Test your SCIM setup with one person first. In short:
  1. Select Test Connection on the Identity Management tab. On the Living Security Checklist tab, First request received and Connection test passed show Done.
  2. Bind a group that holds the test person to the application. First user received, then First user ready to sign in, show Done within a few minutes.
  3. Open the Attributes tab. Fix each item under What to fix, and check that Attributes received has the attributes you mapped. Compare with the SCIM attribute reference.
  4. To see the exact request JumpCloud sent, look at Newest user on the Attributes tab, or search the SCIM events for the person’s email.
  5. Ask the test person to sign in. First sign-in by a SCIM user shows Done.
  6. Send one group. First group received shows Done.
  7. Remove the test person from the bound group, or suspend them in JumpCloud. The person shows as deactivated in Workforce → People.
When every step shows Done or Not used and the Health tab shows No warnings, widen the scope in JumpCloud.

Troubleshoot

Each failed request has an LS-SCIM code in the error detail. JumpCloud shows it in its provisioning logs. Open Troubleshoot SCIM → Health in Living Security for failed requests, held accounts and token expiry. Some changes succeed in JumpCloud but are held in Living Security, for example a change that would remove your last owner. The SCIM card shows Held accounts. See Held changes. Every code is in the SCIM error reference. For a support request, select Copy diagnostics on the troubleshooting page. It has no names, email addresses or tokens.

The connection test fails

  • The test user already exists. JumpCloud’s test creates the Test User Email. Use an email that is not in Living Security, or a new address each time.
  • 401. Check that the token type is Bearer Token and that the base URL is your organization’s regional URL from the SCIM card.