Configuring Just-In-Time (JIT) Provisioning

Required User Credentials

[Flosum User] - SystemAdministrator Role

Overview

Flosum supports Just-In-Time (JIT) Provisioning for both OIDC and SAML identity providers. JIT Provisioning automatically creates and updates user accounts in Global Settings when a user first logs in via SSO. Since the identity provider supplies user information, JIT Provisioning saves time by eliminating the need to manually create users. Your identity provider must be properly configured before you enable JIT Provisioning.

You can use SCIM as an alternative to JIT Provisioning, or combine the two. The SCIM API automates user provisioning in your Flosum tenant, letting you provision, manage, and deprovision users seamlessly. For more details about SCIM, see the article below.

• Configuring SCIM for Flosum

Enabling JIT Provisioning

Enabling JIT Provisioning for an identity provider is done when creating or editing the identity provider.

1. Check the Just-In-Time Provisioning checkbox to enable this feature.

2. Click Save to save the change.

   

For more details about creating or editing an identity provider, see the following articles.

• Adding an Identity Provider (SSO)

• Managing Identity Providers (SSO)

Identity Provider Mapped Attributes

For an identity provider to be able to use JIT Provisioning to add user accounts to your Flosum tenant, you must configure your identity provider to map user attributes to specific values. See the following table for a list of the attributes.

User Attribute	Description
uniqueUserId	The ID used by the identity provider to identity user accounts.
firstName	The first or given name of the user.
lastName	The last or surname of the user.
email	The email address of the user.

The following sections provide information on configuring specific identity providers to work with JIT Provisioning.

Microsoft Entra ID Attribute Mapping

1. Log in to your Entra ID account.

2. Access the SAML Attributes & Claims page.

3. Ensure your Attributes & Claims are correctly set. See the screenshot and table below.

Claim Name	Value
userUniqueId	user.objectid
firstName	user.givenname
lastName	user.surname
email	user.mail

Okta Attribute Mappin

1. Log in to your Okta account.

2. View your SAML 2.0(Header Auth) on the Sign On tab.

3. Ensure your SAML 2.0 Attributes are correctly set. See the screenshot and table below.

Name	Value
uniqueUserId	user.id
firstName	user.firstName
lastName	user.lastName
email	user.email

PingOne Attribute Mapping

1. Log in to your PinOne account.

2. Access the Attribute Mappings page.

3. Ensure your Attribute mappings are correctly set. See the screenshot and table below.

Claim Name	Value
userUniqueId	User ID
firstName	Given Name
lastName	Family Name
email	Email Address