Configure just-in-time provisioning

Supported in:

SOAR

Note: This document applies only to the standalone Google Security Operations SOAR platform.

This document explains how to configure just-in-time (JIT) provisioning for Okta users and Azure users.

With JIT enabled, Google Security Operations SOAR automatically creates the user after a successful SAML sign-in from the configured Identity Provider (IdP), such as Okta or Google Workspace.

Note: To set up JIT, the administrator must define all relevant fields in the Google SecOps SOAR platform and then map them to the SAML provider. You can only configure JIT for one SAML provider at a time.

Define JIT provisioning for Okta users

1. In Google SecOps SOAR, go to Settings > Advanced > External Authentication.
2. Select Okta and enter the required parameters.
3. Select the JIT provisioning checkbox to display the mapping fields.
4. In Okta, click Directory > Profile Editor. Copy the exact field names and enter them into the corresponding fields in Google SecOps SOAR.
5. Confirm the fields are are identical in the Google SecOps SOAR platform and in Okta, and then save.

Define JIT provisioning for Azure users

1. In Google SecOps SOAR, go to Settings > Advanced > External Authentication.
2. Select Azure and enter the required parameters.
3. Select the JIT provisioning checkbox to display the mapping fields, then use the following standard claim URIs:
• First Name Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname.
• Last Name Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname.
• User Name Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name.
• Email Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name. The Email Attribute can also sometimes be seen as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

Note: If Google SecOps SOAR expects the LoginID to be the user's email, set NameID to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress and map Email to NameID in your IdP.

Need more help? Get answers from Community members and Google SecOps professionals.