Just-in-Time provisioning

Just-in-Time (JIT) provisioning creates and updates user accounts during SSO authentication. JIT verifies that users belong to the organization and assigns them to teams based on your identity provider (IdP) configuration.

How it works

JIT fits organizations that want to give their users the quickest path to access. JIT grants users access the first time they sign in with SSO without needing an invitation.

The following diagram shows SSO sign-in with and without JIT:

---
config:
  themeVariables:
    fontSize: 14px
  flowchart:
    wrappingWidth: 80
    nodeSpacing: 14
    rankSpacing: 22
    padding: 5
    curve: linear
    subGraphTitleMargin:
      top: 4
      bottom: 12
---
flowchart LR
  start(["Sign in with SSO"]) --> invite["Accept pending invitation"]
  invite --> jit{"JIT enabled?"}
  jit -->|Yes| map{"IdP group mappings?"}
  map -->|Yes| assign
  map -->|No| default
  subgraph jitbox["JIT provisioning"]
    assign["Add to orgs and teams from IdP"]
    default["Add to default org and team"]
  end
  assign --> ok(["SSO successful"])
  default --> ok
  jit -->|No| member{"Member of org?"}
  member -->|Yes| ok
  member -->|No| denied(["Access denied"])

  classDef success fill:#22c55e22,stroke:#22c55e
  classDef failure fill:#ef444422,stroke:#ef4444
  class ok success
  class denied failure
  style jitbox fill:#3b82f622,stroke:#3b82f6

When a user signs in with SSO, Docker looks for a Docker account with the email address your IdP sent. If none exists, Docker creates one and generates a unique username from the user's email, name, and random numbers. If one exists, Docker updates the user's full name if it changed.

If JIT is disabled, sign-in succeeds only for organization members and users with a pending invitation, which Docker accepts at sign-in. Everyone else sees an Access denied error and must ask an administrator for an invitation.

Set up

When you create an SSO connection, Docker turns on JIT provisioning by default. To set up JIT provisioning:

1. Set up an SSO connection for your organization.
2. Set the default organization and team that Docker uses for users who sign in without IdP group mappings. You set these when you create the SSO connection.
3. Optional. Set up group mapping to assign users to organizations and teams from your IdP.
4. Have your users sign in with SSO.

JIT doesn't remove users when they leave your IdP, so you must remove them manually. To remove users automatically, use SCIM.

Disable

Warning

Disabling JIT provisioning may disrupt your users' access and workflows. With JIT disabled, only existing organization members and users with a pending invitation can sign in with SSO.

An SSO connection must keep at least one provisioning method enabled: JIT, SCIM, or both. You can disable JIT only while SCIM is enabled, and you can disable SCIM only while JIT is enabled. Before you add SCIM, review how SCIM works with JIT. Disable JIT if you want SCIM to be the source of truth for provisioning.

To disable JIT provisioning:

1. Go to Docker Home and select your organization from the top-left account drop-down.
2. Select Identity & auth, then SSO and SCIM.
3. In the SSO connections table, select the Actions icon, then select Disable JIT provisioning.
4. Select Disable to confirm.

Re-enable

If you disabled JIT provisioning, you can turn it back on:

1. Go to Docker Home and select your organization from the top-left account drop-down.
2. Select Identity & auth, then SSO and SCIM.
3. In the SSO connections table, select the Actions icon, then select Enable JIT provisioning.
4. Select Enable to confirm.

Next steps

• Set up group mapping to automatically assign users to teams.
• Review Troubleshoot provisioning.