Just-in-Time Provisioning

Add users who aren’t members of your organization yet when they sign in through SSO, and grant admin from an exact identity provider attribute match.

Just-in-time (JIT) provisioning adds a user who isn’t already a member of your organization when they sign in through your SSO connection. There’s no invitation to send and no directory push to configure. An assigned user who isn’t a member yet signs in with SSO and joins your organization, existing StackOne users included.

JIT rides on your SSO connection, so set up SSO first. It’s a lighter-weight alternative to SCIM Provisioning. JIT adds a user at the moment of their sign-in. SCIM Provisioning creates members ahead of time from your directory.

How JIT works

On every SSO sign-in, if the user isn’t a member of your organization yet, StackOne:

• Adds them to your organization at the role your identity provider asserts, Viewer by default and Admin on an exact attribute match (see Organization role).
• Grants them the connection’s provisioned access, the projects you selected at the roles you set.

Users who already have a StackOne account join the same way. Anyone who is already a member at sign-in is left untouched. Their role stays as it is, and access you removed from them isn’t granted again. Adjust roles from the dashboard.

Removing a member doesn’t keep them out while they can still sign in through your identity provider. They rejoin on their next sign-in as if provisioned for the first time. Unassign them from the StackOne application in your identity provider instead, or use Disable Member under Organization > Manage Team.

Only email addresses on the verified domain itself are provisioned. To link an existing StackOne account, its email address must be on the verified domain (or already be a trusted directory email from SCIM Provisioning).

A pending invitation always wins. If the user signing in has one for your organization, JIT steps aside and the invitation’s role is used instead. SCIM Provisioning also takes precedence, so a user your directory already created keeps the membership it gave them.

Organization role from your identity provider

By default, JIT provisions members as organization Viewers, the least-privilege role. To provision someone as an organization Admin, have your identity provider send a fixed attribute on the SSO assertion:

Attribute	Value	Organization role
stackone_role	admin	Admin
stackone_role	any other value, or absent	Viewer

The value is matched case-insensitively and trimmed, but it must be exactly admin. admin, Admin, and ADMIN all grant admin, while administrator, admin-readonly, an empty value, or a missing attribute all resolve to Viewer. StackOne never grants anything above organization admin from an identity provider attribute, so an unexpected value can only ever leave a member as a viewer.

Send stackone_role as a SAML attribute statement named exactly stackone_role. Send the value admin only for the people who should administer the organization, and leave the attribute off everyone else so they’re provisioned as viewers.

This is the same mapping SCIM Provisioning uses: a SCIM roles value of admin provisions an organization admin, and everything else a viewer.

Organization admins can manage members, connections, and billing for the whole organization. Treat stackone_role: admin as you would any admin grant, and drive it from a group or rule in your identity provider that you already trust to define your StackOne admins.

Prerequisites

• A verified SSO connection for your organization. JIT provisions members as they sign in through it. See SSO overview.
• The Org Admin role to configure the defaults.

JIT is turned on per connection with the Enable JIT action, so nothing to request from support. The projects and roles you set are the connection’s shared provisioned access: SCIM Provisioning applies the same set, so configuring it once covers both.

Set up JIT

1. Set the provisioned access

   In the StackOne dashboard, go to Organization > Security > SSO and open your verified SSO connection. Select the Provisioning tab, then, on the Provisioned access card, select Manage access.

   Pick the projects provisioned members should join and choose a role for each one (Viewer, Member, or Admin), then select Save changes. Pick the least-privilege role that fits each project. This sets project access only; the organization role comes from your identity provider.

   
2. Enable JIT

   On the Just-in-time provisioning card, select Enable JIT. Provisioning starts on the next sign-in. If you haven’t set any provisioned access yet, enabling JIT walks you through it first. A member is never provisioned into nothing.

3. Send the role attribute from your identity provider

   To grant organization admin to specific people, configure your identity provider to send the stackone_role attribute with the value admin for them, as described in Organization role. Leave it off everyone who should stay a viewer.

4. Assign users and have them sign in

   Assign the users to the StackOne application in your identity provider. On their next SSO sign-in, StackOne creates their membership at the organization role and provisioned access above.

Next steps

SSO overview

Set up the SSO connection JIT provisions members through.

SCIM Provisioning

Provision members ahead of time from your directory over SCIM.

Groups

Grant many members the same project or account access at once.

Set up SSO with Okta

Connect Okta as your SAML identity provider.