Staff identity

JumpCloud is FINNS’s employee directory. The admin console signs staff in with it over OpenID Connect, so staff use their normal company account and leaving the company removes access.

Issuer	https://oauth.id.jumpcloud.com/
Client	Confidential (client secret held by the admin console Worker)
Flow	Authorization code + PKCE, scopes openid email profile
Group claim	memberOf; the group Guest Activation Applications may sign in
Talks to	The admin console only. Core never sees a JumpCloud token.

flowchart LR
  classDef ours fill:#13686C,stroke:#0B4A4D,color:#ffffff
  classDef ext fill:#F3ECDF,stroke:#B9A88B,color:#12191B
  classDef staff fill:#FDE9E2,stroke:#E9724C,color:#12191B
  classDef person fill:#E9724C,stroke:#C55A37,color:#ffffff

  s(["Staff"]):::person --> jc["JumpCloud<br/>who is an employee,<br/>which groups"]:::ext
  jc -- "ID token + userinfo" --> w["Admin console Worker"]:::staff
  w -- "sub + email" --> core["Core staff table<br/>who may use Trident,<br/>which role"]:::ours

Access needs both: the JumpCloud group and an active row in core’s staff table. See Admin console for the full sequence.