Using Just-in-Time Provisioning (JITP)

Configure ADFS Server

Before enabling Just-in-Time Provisioning (JITP), an administrator will have to configure settings on the ADFS server:

1. Select the Relying Party Trust and select Edit Claim Issuance Policy.
2. As an admin, create a new Rule named JITP with the following LDAP Attributes:

• Rule Type: Send LDAP Attributes as Claims
• Given-Name: Given Name
• Surname: Surname
• Token-Groups - Unqualified Names: Group

NOTE: See Configure ADFS Integration Instructions for additional resources.

Enable JITP

1. Go to Management > Integrations and click  next to the integration.
2. Click Identity Management.
3. Scroll to the bottom and check the Enable JITP check box.
4. Specify the desired group prefix and click SAVE.

NOTE: Any integration group with the specified prefix will be added to OWS automatically as soon as a user in that group logs in.

5. In Active Directory Users and computers click on the Create a new group icon.
6. Give the new group a name that starts with the prefix specified in step 4.
7. Click OK.

8. Double-click on an existing user or create a new user.
9. Click on the Member Of tab.
10. Click Add and add the group that was created in Step 6.
11. Click Apply.
12. Click OK.

 

13. Log in to OWS if not already logged in.
14. Go to Management > User Groups.
15. Click ADD NEW USER GROUP. 
16. Add a group with the same name specified in step 6 without the prefix (WS- by default).
17. Click CREATE.

18. Select desired Web Services, Location and Client permissions for the group.

NOTE: Any integration group with the specified prefix will be added to OWS automatically as soon as a user in that group logs in.

19. Any user associated with the group will now be able to log in with the permissions set in step 18.

Related Links

ADFS Integration Instructions