"use strict"; const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0]; const {useMDXComponents: _provideComponents} = arguments[0]; const headings = [{ "data": { "id": "do-you-need-to-implement-just-in-time-provisioning-for-your-product", "hProperties": { "id": "do-you-need-to-implement-just-in-time-provisioning-for-your-product" } }, "depth": 2, "value": "Do you need to implement Just-in-Time provisioning for your product?" }, { "data": { "id": "rapid-onboarding", "hProperties": { "id": "rapid-onboarding" } }, "depth": 3, "value": "Rapid onboarding" }, { "data": { "id": "mergers-acquisitions-and-temporary-workers", "hProperties": { "id": "mergers-acquisitions-and-temporary-workers" } }, "depth": 3, "value": "Mergers, acquisitions, and temporary workers" }, { "data": { "id": "is-it-specific-to-saml-and-enterprise-sso", "hProperties": { "id": "is-it-specific-to-saml-and-enterprise-sso" } }, "depth": 2, "value": "Is it specific to SAML and Enterprise SSO?" }, { "data": { "id": "does-it-apply-to-new-or-existing-users-of-the-app", "hProperties": { "id": "does-it-apply-to-new-or-existing-users-of-the-app" } }, "depth": 2, "value": "Does it apply to new or existing users of the app?" }, { "data": { "id": "what-is-the-difference-between-jit-and-scim", "hProperties": { "id": "what-is-the-difference-between-jit-and-scim" } }, "depth": 2, "value": "What is the difference between JIT and SCIM?" }, { "data": { "id": "just-in-time-provisioning-in-logto", "hProperties": { "id": "just-in-time-provisioning-in-logto" } }, "depth": 2, "value": "Just-in-Time provisioning in Logto" }, { "data": { "id": "enterprise-sso-provisioning", "hProperties": { "id": "enterprise-sso-provisioning" } }, "depth": 3, "value": "Enterprise SSO provisioning" }, { "data": { "id": "email-domains-provisioning", "hProperties": { "id": "email-domains-provisioning" } }, "depth": 3, "value": "Email domains provisioning" }, { "data": { "id": "email-flow", "hProperties": { "id": "email-flow" } }, "depth": 4, "value": "Email flow" }, { "data": { "id": "social-flow", "hProperties": { "id": "social-flow" } }, "depth": 4, "value": "Social flow" }, { "data": { "id": "handling-email-domain-provisioning-and-enterprise-sso-potential-conflict", "hProperties": { "id": "handling-email-domain-provisioning-and-enterprise-sso-potential-conflict" } }, "depth": 4, "value": "Handling email domain provisioning and enterprise SSO potential conflict" }, { "data": { "id": "default-organization-roles", "hProperties": { "id": "default-organization-roles" } }, "depth": 3, "value": "Default organization roles" }, { "data": { "id": "enterprise-sso-just-in-time-update", "hProperties": { "id": "enterprise-sso-just-in-time-update" } }, "depth": 2, "value": "Enterprise SSO Just-in-Time update" }]; const readingTime = { "minutes": 7, "words": 2113, "text": "7 min read" }; const frontmatter = undefined; function _createMdxContent(props) { const _components = { a: "a", code: "code", em: "em", h2: "h2", h3: "h3", h4: "h4", img: "img", li: "li", ol: "ol", p: "p", pre: "pre", span: "span", strong: "strong", table: "table", tbody: "tbody", td: "td", th: "th", thead: "thead", tr: "tr", ul: "ul", ..._provideComponents(), ...props.components }, {LogtoCloudButton, Note} = _components; if (!LogtoCloudButton) _missingMdxReference("LogtoCloudButton", true); if (!Note) _missingMdxReference("Note", true); return _jsxs(_Fragment, { children: [_jsx(_components.p, { children: "Before we discuss Just-in-Time provisioning, imagine you’re building a SaaS B2B app and want to support membership features, allowing members to easily join your workspace (tenant). What features would you propose? Here’s a checklist for you:" }), "\n", _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "Scenario" }), _jsx(_components.th, { children: "Flow" })] }) }), _jsxs(_components.tbody, { children: [_jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Admin invite" }), _jsx(_components.td, { children: "Users can receive an email invitation to join the organization." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Management API user creation or import" }), _jsx(_components.td, { children: "Users can use a pre-created user account to join the organization." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Just-in-Time provisioning" }), _jsx(_components.td, { children: "Users who log in the app for the first time can join the organization." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Directory Sync (eg. SCIM)" }), _jsx(_components.td, { children: "Use the IdP’s Directory Sync functionality to pre-provision users in the app in advance." })] })] })] }), "\n", _jsx(_components.p, { children: "Just-in-Time (JIT) provisioning is a process used in identity and access management systems to create user accounts on the fly as they sign in to a system for the first time. Instead of pre-provisioning accounts for users in advance, JIT provisioning creates and configures the necessary user accounts dynamically when a user authenticates.\nJust-in-time provisioning is a popular feature with its own characteristics, such as efficiency, no administrative involvement, and automated organization membership, etc.\nNow that you understand the basics of Just-in-Time provisioning, you might have several questions as you dive deeper into real-world product development. I’ll address these questions, which can be controversial and highly dependent on your specific business cases." }), "\n", _jsxs(_components.h2, { id: "do-you-need-to-implement-just-in-time-provisioning-for-your-product", children: ["Do you need to implement Just-in-Time provisioning for your product?", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#do-you-need-to-implement-just-in-time-provisioning-for-your-product", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "These cases are common when building a B2B app that involves multi-tenant architecture, enterprise SSO, working with enterprises, or requiring team onboarding features. Here are some sample scenarios your client may encounter." }), "\n", _jsxs(_components.h3, { id: "rapid-onboarding", children: ["Rapid onboarding", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#rapid-onboarding", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "You have a client experiencing frequent hiring or rapid growth can use JIT provisioning to quickly set up user accounts for new employees. Let’s take an example:" }), "\n", _jsxs(_components.p, { children: ["Sarah is a new employee at Company ", _jsx(_components.code, { children: "SuperFantasy" }), ", which uses ", _jsx(_components.code, { children: "Okta" }), " as its Enterprise Identity Provider. The HR team add her as an business identity ", _jsx(_components.code, { children: "sarah@superfantacy.com" }), " in Okta just one time. When Sarah uses this email to sign in to a corporate-used productivity app called ", _jsx(_components.code, { children: "Smartworkspace" }), " for the first time, the system automatically creates an account and provisions the right role for her within the company’s workspace. This way, neither Sarah nor the HR team at SuperFantasy needs to go through multiple steps for account creation and role assignment."] }), "\n", _jsxs(_components.h3, { id: "mergers-acquisitions-and-temporary-workers", children: ["Mergers, acquisitions, and temporary workers", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#mergers-acquisitions-and-temporary-workers", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "You have a client experiencing merging or acquiring others, JIT provisioning can simplify the process of granting access to the acquiring company’s systems for many new users. Let’s take another example," }), "\n", _jsxs(_components.p, { children: ["Peter works for ", _jsx(_components.code, { children: "MagicTech" }), ", which was recently acquired by ", _jsx(_components.code, { children: "SuperFantasy" }), ". MagicTech is a smaller organization without enterprise SSO but uses ", _jsx(_components.code, { children: "Smartworkspace" }), "too where Peter already has a business account."] }), "\n", _jsxs(_components.p, { children: ["The HR team can add Peter in ", _jsx(_components.code, { children: "Okta" }), ". When Peter logs into Smartworkspace for the first time through Okta, the system automatically links his existing business account and grants the appropriate access to SuperFantasy."] }), "\n", _jsx(_components.p, { children: "The scenarios above are ideal for implementing the JIT feature." }), "\n", _jsxs(_components.h2, { id: "is-it-specific-to-saml-and-enterprise-sso", children: ["Is it specific to SAML and Enterprise SSO?", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#is-it-specific-to-saml-and-enterprise-sso", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "Just-in-time (JIT) provisioning is often associated with Single sign-on (SSO) in SAML authentication, but it is not exclusive to SAML. JIT provisioning can also be used with other authentication protocols like OAuth 2.0 and OpenID Connect, and it doesn’t always require an Enterprise SSO set-up." }), "\n", _jsx(_components.p, { children: "For instance, email-based JIT provisioning can streamline team onboarding by automatically adding users to a workspace based on their email domain. This is particularly useful for organizations that lack the budget and resources to purchase and manage enterprise SSO." }), "\n", _jsx(_components.p, { children: "The fundamental idea behind JIT provisioning is to automate user account creation or updates when a user first attempts to access a service, regardless of the specific protocol used." }), "\n", _jsxs(_components.h2, { id: "does-it-apply-to-new-or-existing-users-of-the-app", children: ["Does it apply to new or existing users of the app?", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#does-it-apply-to-new-or-existing-users-of-the-app", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "This is a tricky question. Just-in-time (JIT) provisioning generally refers to the first attempt to access an app. However, different products perceive this functionality differently. Some use JIT provisioning just for identity and account creation, while others also include Just-in-Time account updates, such as re-provisioning and attribute synchronization." }), "\n", _jsx(_components.p, { children: "In addition to automatic user creation, SAML JIT Provisioning allows granting and revoking group memberships as part of provisioning. It can also update provisioned users to keep their attributes in the Service Provider (SP) store in sync with the Identity Provider (IDP) user store attributes." }), "\n", _jsx(_components.p, { children: "For example, in Oracle Cloud, Just-in-Time provisioning can be configured in various ways." }), "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "Just-in-Time creation" }), "\n", _jsx(_components.li, { children: "Just-in-Time update" }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.a, { href: "https://docs.oracle.com/en/cloud/paas/identity-cloud/uaids/understand-saml-just-time-provisioning.html", children: "Administering Oracle Identity Cloud Service: Understand SAML Just-In-Time Provisioning." }) }), "\n", _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "When signing in, the user:" }), _jsx(_components.th, { children: "Flow" })] }) }), _jsxs(_components.tbody, { children: [_jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Exists and JIT provisioning is enabled." }), _jsx(_components.td, { children: "Normal SSO failure flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Doesn't exist and JIT creation is enabled." }), _jsx(_components.td, { children: "User is created, and populated with the SAML assertion attributes, as mapped in the JIT configuration." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "Exists and JIT update is enabled." }), _jsx(_components.td, { children: "User attribute values are updated with the SAML assertion attributes, as mapped in the JIT configuration." })] })] })] }), "\n", _jsx(_components.p, { children: "If you do want to consider the subsequent existing user sign-in scenario, make sure you have a robust provisioning system along with your JIT system. For example," }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Conflict resolution" }), ": Your system should have a strategy for handling conflicts if an account already exists with different information than what’s provided by the IdP during the JIT process. This may require detailed control of your organization’s policies and IdP configuration."] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Audit trails" }), ": It's important to maintain logs of both new account creations and updates to existing accounts through JIT processes for security and compliance reasons."] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Performance" }), ": While JIT provisioning happens quickly, consider the potential impact on sign-in times, especially for existing users if you're updating their information at each sign-in."] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Data consistency" }), ": Ensure that your JIT provisioning process maintains data consistency, especially when updating existing user accounts."] }), "\n"] }), "\n", _jsx(Note, { children: _jsxs(_components.p, { children: ["Logto offers basic control of just-in-time updates at the Enterprise SSO level. We’ll cover this\nin more detail later in the article. ", _jsx(_components.a, { href: "#just-in-time-provisioning-in-logto", children: "Learn more" }), "👇"] }) }), "\n", _jsxs(_components.h2, { id: "what-is-the-difference-between-jit-and-scim", children: ["What is the difference between JIT and SCIM?", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#what-is-the-difference-between-jit-and-scim", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "In addition to Just-in-Time (JIT) provisioning, you may have heard of SCIM (System for Cross-domain Identity Management). SCIM is an open standard protocol designed to simplify and automate user identity management across different systems and domains. It is commonly used in Directory Sync scenarios." }), "\n", _jsx(_components.p, { children: "The main difference between JIT and SCIM is that JIT creates accounts during the user’s sign-in attempt, while SCIM can provision users through an offline automated process, independent of user login attempts." }), "\n", _jsx(_components.p, { children: "This means JIT focuses on new user onboarding, while SCIM focuses on the full lifecycle management of users." }), "\n", _jsx(_components.p, { children: "Furthermore, JIT is often an extension of SAML and lacks a standardized implementation across systems, whereas SCIM is a well-defined, standardized protocol (RFC 7644) for identity management." }), "\n", _jsx(_components.p, { children: "Some larger organizations use SCIM for account provisioning, integrating it with their own systems. This can be very complex and vary case by case. These organizations often have a provisioning system that involves both automated processes and manual admin involvement." }), "\n", _jsxs(_components.h2, { id: "just-in-time-provisioning-in-logto", children: ["Just-in-Time provisioning in Logto", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#just-in-time-provisioning-in-logto", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsxs(_components.p, { children: [_jsx(_components.strong, { children: "SSO Just-in-Time provisioning" }), " and ", _jsx(_components.strong, { children: "Email domain Just-in-Time provisioning" }), " are what we embrace in Logto."] }), "\n", _jsx(_components.p, { children: "In Logto, we have this feature set at the organization level that allows users to automatically join the organization and receive role assignments if they meet specific criteria." }), "\n", _jsx(_components.p, { children: "We implement the JIT feature at its most scalable and secure level to simplify and automate the provisioning process for developers onboarding their clients. However, like we discussed earlier, since provisioning systems can be complex and tailored to your clients’ specific needs, you should leverage Logto’s pre-built JIT features, your careful system design, and the Logto management API to construct a robust provisioning system." }), "\n", _jsx(_components.p, { children: "Let’s take this diagram to see how it works in Logto," }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { className: "language-mermaid", children: "stateDiagram-v2\ndirection LR\n\nclassDef provision font-weight: bold, stroke-width: 2px;\nclass sso_provision, email_provision provision\n\nstate has_account <>\nauthentication: User
authentication\nsign_in: Sign in\ncreate_account: Create account\nstate is_sso_1 <>\nstate is_sso_2 <>\nsso_provision: Provision by
enterprise SSO\nemail_provision: Provision by
email domain\n\n[*] --> authentication\nauthentication --> has_account: User exists?\nhas_account --> sign_in: Yes\nhas_account --> create_account: No\nsign_in --> is_sso_1: Is SSO
and first time?\nis_sso_1 --> [*]: No\nis_sso_1 --> sso_provision: Yes\ncreate_account --> is_sso_2: Is SSO?\nis_sso_2 --> sso_provision: Yes\nsso_provision --> [*]\nis_sso_2 --> email_provision: No\nemail_provision --> [*]\n" }) }), "\n", _jsx(Note, { children: _jsx(_components.p, { children: "Just-in-time (JIT) provisioning only triggers for user-initiated actions and does not affect\ninteractions with the Logto management API." }) }), "\n", _jsxs(_components.h3, { id: "enterprise-sso-provisioning", children: ["Enterprise SSO provisioning", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#enterprise-sso-provisioning", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "If you have Enterprise SSO set up in Logto, you can select your organization enterprise SSO to enable just-in-time provisioning." }), "\n", _jsxs(_components.p, { children: ["New or existing users signing in through enterprise SSO ", _jsx(_components.strong, { children: _jsx(_components.em, { children: "for the first time" }) }), " will automatically join the organization and get default organization roles."] }), "\n", _jsx(_components.p, { children: "The following table list out the potential flows:" }), "\n", _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "User status" }), _jsx(_components.th, { children: "Flow description" })] }) }), _jsxs(_components.tbody, { children: [_jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist, and JIT is enabled." }), _jsx(_components.td, { children: "User is created and automatically joins the corresponding organization with appropriate roles." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists with the same verified email address as the enterprise SSO, and JIT is enabled." }), _jsx(_components.td, { children: "User’s email address is automatically linked with the enterprise SSO account, and they join the corresponding organization with appropriate roles." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal SSO failure flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal SSO flow." })] })] })] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "https://uploads.strapi.logto.io/1/sso_provisioning_e891f182b8.webp", alt: "SSO provisioning" }) }), "\n", _jsxs(_components.h3, { id: "email-domains-provisioning", children: ["Email domains provisioning", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#email-domains-provisioning", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "If an organization doesn’t have a dedicated enterprise SSO, you can use email domains to enable Just-in-Time provisioning. This usually happens to smaller businesses that don’t have the budget for enterprise SSO but still want some level of member onboarding automation and security management." }), "\n", _jsx(_components.p, { children: "When users sign up, if their verified email addresses match the configured email domains at the organization level, they will be provisioned to the appropriate organization(s) with the corresponding roles." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "https://uploads.strapi.logto.io/1/email_provisioning_ab643053fd.webp", alt: "Email domain provisioning" }) }), "\n", _jsx(_components.p, { children: "Email domain provisioning works for:" }), "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "Email sign-up authentication" }), "\n", _jsx(_components.li, { children: "Social sign-up authentication" }), "\n"] }), "\n", _jsxs(Note, { title: "Why doesn’t email domain provisioning apply to the existing user sign-in process?", children: [_jsx(_components.p, { children: "Existing user sign-in requires further control to determine if they can be provisioned to a specific organization or granted a role. This process is dynamic and depends on specific use cases and business needs, such as subsequent log-in strategies and organization-level policies." }), _jsx(_components.p, { children: "For example, if you enable email domain provisioning for an existing user and later want to onboard another group of users with a different role, should the previously onboarded user be assigned the new role you set up?" }), _jsx(_components.p, { children: "This creates a complex scenario for “Just-in-Time updates”. The exact behavior often depends on how the application, organization setting and IdP integration are configured. We give this control to our developers, allowing you to design your provisioning system freely and handle the most frequent scenarios for new account creation and organization onboarding." })] }), "\n", _jsxs(_components.h4, { id: "email-flow", children: ["Email flow", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#email-flow", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "User status" }), _jsx(_components.th, { children: "Flow description" })] }) }), _jsxs(_components.tbody, { children: [_jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist and signs up with email, and JIT is enabled." }), _jsx(_components.td, { children: "User is created and automatically joins the corresponding organization with appropriate roles." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists with the same verified email address as provisioned email domains, and JIT is enabled." }), _jsx(_components.td, { children: "Normal email sign-in flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist and signs up with email, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal email sign-up flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists and signs in with email, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal email sign-in flow." })] })] })] }), "\n", _jsxs(_components.h4, { id: "social-flow", children: ["Social flow", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#social-flow", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "User status" }), _jsx(_components.th, { children: "Flow description" })] }) }), _jsxs(_components.tbody, { children: [_jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist, signs up with social account using a verified email, and JIT is enabled." }), _jsx(_components.td, { children: "User is created and automatically joins the corresponding organization with appropriate roles." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist, signs up with social account using an unverified email or no email, and JIT is enabled." }), _jsx(_components.td, { children: "Normal social sign-up flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists with the same verified email address as provisioned email domains, signs in through social account, and JIT is enabled." }), _jsx(_components.td, { children: "Normal social sign-in flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User does not exist, signs up with social account, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal social sign-up flow." })] }), _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "User exists, signs in with social account, and JIT is not enabled." }), _jsx(_components.td, { children: "Normal social sign-in flow." })] })] })] }), "\n", _jsxs(_components.h4, { id: "handling-email-domain-provisioning-and-enterprise-sso-potential-conflict", children: ["Handling email domain provisioning and enterprise SSO potential conflict", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#handling-email-domain-provisioning-and-enterprise-sso-potential-conflict", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "If you initially set up email domain provisioning and later configure an Enterprise SSO with the same email domain, here's what happens:" }), "\n", _jsx(_components.p, { children: "When a user enters their email address, they will be redirected to the SSO flow, bypassing the email authentication. This means the JIT process won’t be triggered." }), "\n", _jsx(_components.p, { children: "To address this, we will show a warning message when configuration. Ensure you handle this flow by selecting the correct SSO to enable just-in-time provisioning, and do not rely on email domain provisioning." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "https://uploads.strapi.logto.io/1/jit_conflict_fafd37643c.webp", alt: "Conflict resolution" }) }), "\n", _jsxs(_components.h3, { id: "default-organization-roles", children: ["Default organization roles", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#default-organization-roles", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "When provisioning users, you can set their default organization roles. The role list comes from the organization template, and you can choose a role or leave it empty." }), "\n", _jsxs(_components.h2, { id: "enterprise-sso-just-in-time-update", children: ["Enterprise SSO Just-in-Time update", _jsx(_components.a, { "aria-hidden": "true", tabIndex: "-1", href: "#enterprise-sso-just-in-time-update", children: _jsx(_components.span, { children: "#" }) })] }), "\n", _jsx(_components.p, { children: "Luckily, we already have this feature built into Enterprise SSO! You can choose whether profile information is synced to Logto at the first sign-in or every sign-in. We’ll also consider adding more features like role and organization mapping and reprovisioning in the future." }), "\n", _jsxs(_components.p, { children: [_jsx(_components.img, { src: "https://uploads.strapi.logto.io/1/sso_jit_update_f4dbf156a8.webp", alt: "SSO JIT update" }), "\nCheck ", _jsx(_components.a, { href: "https://docs.logto.io/docs/recipes/single-sign-on/configure-sso/#step-3-customize-sso-experience-and-email-domain", children: "this" }), " to learn more."] }), "\n", _jsx(_components.p, { children: "The Just-in-Time feature is available immediately in Logto. Sign up for Logto today and start automating your clients’ membership onboarding." }), "\n", _jsx(LogtoCloudButton, {})] }); } function MDXContent(props = {}) { const {wrapper: MDXLayout} = { ..._provideComponents(), ...props.components }; return MDXLayout ? _jsx(MDXLayout, { ...props, children: _jsx(_createMdxContent, { ...props }) }) : _createMdxContent(props); } return { headings, readingTime, frontmatter, default: MDXContent }; function _missingMdxReference(id, component) { throw new Error("Expected " + (component ? "component" : "object") + " `" + id + "` to be defined: you likely forgot to import, pass, or provide it."); }