JumpCloud sells a cloud directory with LDAP, RADIUS, SSO, MFA and device management as packages or per product. Pages here cover replacing its identity services with self-hosted authentik, FreeIPA or Keycloak.
Comparing JumpCloud's cloud directory, LDAP, RADIUS and SSO with self-hosted authentik, which provides SSO plus LDAP and RADIUS outposts in one product: protocol coverage, what authentik's Enterprise edition adds, device management that authentik does not replace, and who runs it.
For Linux-heavy fleets using JumpCloud for user accounts, LDAP and SSH access: what FreeIPA offers with its LDAP directory, Kerberos, host-based access control, sudo rules and OTP, what it leaves out (SaaS SSO and Windows or macOS device management), and the operating effort.
JumpCloud bundles a directory with SSO; Keycloak is an SSO and identity broker that needs a user store. This page compares SSO, MFA and federation, explains why LDAP clients and RADIUS devices need another component next to Keycloak, and when that split is worth it.
Moving from JumpCloud to authentik: exporting users from the Admin Portal, re-creating groups, repointing LDAP clients and RADIUS devices to authentik outposts, re-federating SSO apps, re-enrolling MFA, and sequencing the cutover so devices keep authenticating.
Moving Linux users, groups and SSH access from JumpCloud to FreeIPA: importing exported users, enrolling hosts with SSSD, translating access rules to HBAC and sudo rules, setting up replicas, and handling the apps that still need web SSO.
Cost of ownership by component: JumpCloud packages or a la carte products per user, monthly versus annual billing and suspended users that are still billed, against authentik's open source or Enterprise edition, servers and PostgreSQL, migration and ongoing operations.
What JumpCloud lets you export from the Admin Portal, selected users, a view or all data as CSV or JSON, what the export leaves out such as passwords and MFA enrollments, and how to plan re-enrollment and directory rebuilds before the contract ends.
Replacing JumpCloud Cloud LDAP for apps, NAS devices and Linux hosts that bind over LDAP: choosing between OpenLDAP, LLDAP, FreeIPA and authentik's LDAP outpost by scale and features, and moving bind accounts and group filters without breaking clients.
Replacing JumpCloud Cloud RADIUS for Wi-Fi and VPN authentication with a RADIUS service on your own network: authentik's RADIUS provider or privacyIDEA for RADIUS with MFA, shared secrets and device configuration, and what changes when the endpoint is no longer in JumpCloud's cloud.
For European organizations weighing JumpCloud's Frankfurt data center, which only new customers can choose and where processing may still happen outside the EU under the DPA, against running authentik or FreeIPA in their own or an EU provider's datacenter.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.