Note:

Configure Just-In-Time Provisioning for SAML based IDP in IDCS/Identity Domains

Introduction

SAML based Just-In-Time (JIT) Provisioning helps in automating the user creation of identities in Identity Cloud Service for new users. The user accounts are created when the user tries to access the target application via SSO. Along with user creation, JIT can also grant and revoke group memberships as a part of provisioning. JIT can also be used to update the provisioned users via mapping the source attributes (Service Provider - SP) to Identity Provider – IDP.

By enabling JIT Provisioning for your Identity Provider with IDCS, you will be able to manage users more efficiently and it will help you to reduce the administration cost of manually synchronizing the users.

Benefits of using JIT Provisioning

Objective

Configure Just-In-Time Provisioning for SAML based IDP in IDCS/Identity Domains via REST APIs.

Note: If your tenancy is already migrated to Identity Domains and if you would like to perform this setup via console, refer to the following link: Adding a Just-in-Time SAML IdP.

Prerequisites

Task 1: Fetch the list of Identity Providers configured in your IDCS/Identity Domains tenancy

Task 2: Fetch the details of the configured SAML IDP

Fetch the details of the configured SAML IDP where you want to enable JIT Provisioning using the located Provider ID from Task 1.

Task 3: Update the IDP provider settings to enable JIT Provisioning

Update the IDP provider settings to enable JIT Provisioning for your SAML IDP using a PATCH operation.

Note:

Sample Body:

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "jitUserProvEnabled",
      "value": true
    },{
      "op": "replace",
      "path": "jitUserProvCreateUserEnabled",
      "value": true
    },
    {
      "op": "replace",
      "path": "jitUserProvAttributeUpdateEnabled",
      "value": true
    },
    {
      "op": "replace",
      "path": "jitUserProvGroupAssertionAttributeEnabled",
      "value": false
    },
    {
      "op": "replace",
      "path": "jitUserProvGroupSAMLAttributeName",
      "value": "groups"
    },
    {
      "op": "replace",
      "path": "jitUserProvGroupAssignmentMethod",
      "value": "Overwrite"
    }
  ]
}

The following table describes the above mentioned IDP properties.

Identity Provider Property Description
jitUserProvEnabled Boolean property to enable/disable the SAML JIT Provisioning feature for the configured IDP.
jitUserProvCreateUserEnabled Boolean property for user creation, based on the incoming assertion, if the user does not yet exist.
jitUserProvAttributeUpdateEnabled Boolean property for user update based on the incoming assertion if the user already exists.
jitUserProvGroupAssertionAttributeEnabled Boolean property indicating whether group memberships should be assigned to the user based on a list of group names received from the IDP in a SAML attribute.
jitUserProvGroupSAMLAttributeName The name of the SAML assertion attribute that will contain groups to be assigned to the user, if the property jitUserProvGroupAssertionAttributeEnabled is true.
jitUserProvGroupAssignmentMethod String property that controls how group memberships will be assigned to the Identity Cloud Service user- Overwrite/ Merge.

Post this operation, your JIT Provisioning should be enabled for the SAML IDP and you can confirm this by running the GET operation mentioned in Task 2. The following image shows the sample output.

Image 3

This will now give you the Mapped Attribute ID which will be used in the next endpoint for mapping the SP attributes with IDP attributes.

Image 4

Task 4: Set the jitUserProvAttributes Mapping for your SAML Identity Provider for user provisioning

After enabling the JIT Provisioning for your SAML IDP, the next step is to map the Service Provider Attributes with the Identity Provider Attributes. Use the Mapped Attribute ID from Task 3 with the REST endpoint described in this section.

Note:

Task 5: Configure the jitUserProvAttributes Mapping Update attribute

Configure the jitUserProvAttributes Mapping Update attribute from Service Provider - SP to Identity Provider - IDP.

Task 6: Test the JIT Provisioning

  1. In a fresh browser session, try to login to IDCS my console.
  2. IDCS will display the login screen.
  3. Select the configured IDP which is now enabled with JIT Provisioning.
  4. IDCS will route you to the IDP login page for signing in.
  5. Enter the valid credentials of the user which does not exist in IDCS.
  6. Post successful login you should route to IDCS my console screen.
  7. Validate via admin account that the user was successfully created in IDCS.

Acknowledgments

Author - Chetan Soni (Cloud Solutions Engineer)

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.