New article
Recently updated
Configuring Just-in-Time (JIT) provisioning
Who is this article for?
Administrators managing user access.
Administration module access is needed.
Just-In-Time (JIT) provisioning automates user account creation or updates using information from the identity provider's token.
When a new user logs into an authorised app for the first time, their details are sent from the identity provider to the Ideagen Quality Management system to create or update their account.
This article outlines the steps to enable this provisioning.
Note
Just-In-Time provisioning is disabled for tenants using Mazlan Home to avoid potential duplication and sync issues.
Overview
To use JIT provisioning, you need to configure a Single Sign-On (SSO) connection between the identity provider (IdP) and Ideagen Quality Management to ensure they’ve included the user attributes the service providers require.
Then when a new user tries to log in for the first time, they will trigger the creation of their account automatically, rather than requiring an admin or manager to create the account for them during on boarding.
Note
Family Name and Given Name is mandatory for JIT to work. You need to configure this information in user profile of the SSO.
Configuring Just-in-Time (JIT) provisioning
To configure JIT provisioning:
- Open the Administration module.
- Select to Security.
- Go to Settings and defaults.
- Then Authentication.
- Scroll to the Single Sign-On Settings section.
- Tick Enable Single Sign On (SSO).
- Click Save.
If you find that enabling this provisioning results in duplicate accounts being created, have a look at our article on troubleshooting duplicate accounts created via SSO.
To configure JIT provisioning:
- Launch the Administration module.
- Navigate to the Security section.
- Select Settings and Defaults.
- Click Edit in the Authentication section.
- Browse to the Single Sign-On Options section.
- Tick Enable Just in Time provisioning for Single Sign-On users.
- Click OK.
If you find that enabling this provisioning results in duplicate accounts being created, have a look at our article on troubleshooting duplicate accounts created via SSO.
Is the user being asked to sign in with Ideagen Quality Management credentials?
When JIT is enabled and the user doesn't have a User Principal Name (UPN) set in the system, they'll need to enter the credentials they had set up in the IdP portal when logging in. The system will then create an account with a secondary license.
Once their account is created, you can log in using either SSO or the native methods.