What is Just-In-Time (JIT) user onboarding?

Just-In-Time (JIT) provisioning, or user onboarding, is an Akeneo Premium feature of Single Sign-On (SSO). It creates or matches a PIM user when that person signs in through your Identity Provider (IdP) for the first time.

The main use case behind Just-in-Time (JIT) user provisioning is to automate and accelerate user account creation the very first time a user logs into Akeneo app via Single Sign-On (SSO), eliminating the need for IT administrators to manually create and configure accounts in advance. 

With JIT user onboarding, nobody has to create or configure PIM users in advance. The first time a person signs in to Akeneo PIM through SSO, the PIM creates their user from the information sent by your IdP. This removes an IT bottleneck for new hires, contractors, partners, and temporary users. Instead of creating every PIM user manually, you manage access in your IdP: with mapping rules, the IdP groups a person belongs to decide their PIM Roles and User Groups.

Understand how JIT user onboarding works

At the first SSO sign-in, Akeneo PIM checks whether a matching PIM user already exists, first through the linked Akeneo Product Cloud identity, then by email address.

• New user: Akeneo PIM creates an enabled PIM user. The email becomes the username, and the first and last names come from the IdP.
• Existing user: Akeneo PIM matches the person through the linked Akeneo Product Cloud identity or, if needed, the email address. It updates the name from the IdP.
• Different email addresses: Akeneo PIM creates a second PIM user. Align the email address in Akeneo PIM and the IdP before the person signs in.

Manage access with your IdP

Use IdP groups and mapping rules to give people the appropriate PIM access when they sign in. For example, assign a new merchandiser to an IdP group that maps to the Editor Role and the relevant User Group.

JIT provisioning does not replace your access model. Before enabling it, create the Roles and User Groups you need in Akeneo PIM, then configure mapping rules that assign them from IdP groups.

Understand password access

Users provisioned automatically through SSO do not have a PIM password. They sign in through the Identity Provider, and password recovery does not apply to that account.

Users who already have a PIM password can use the password sign-in address when needed, for example, if they are not managed by your IdP or the IdP is unavailable.

Offboard JIT users

Because Just-In-Time (JIT) users are managed through your Identity Provider (IdP), you must initiate offboarding directly within the IdP. Once deactivated there, the user cannot log in to Akeneo PIM on their next attempt. However, their account will remain in Akeneo PIM; if you want it permanently deleted, you must remove it manually in the application. Note that if the user also has a local password configured, they may still be able to sign in with it until you disable their PIM user.

Configure SSO connection to enable Just-In-Time user onboarding

Just-in-time user provisioning starts automatically when users sign in through an active Akeneo Product Cloud SSO connection. There is no separate setting to enable it.

1. In Akeneo PIM, open the System menu > Authentication.
2. Confirm that your SSO connection has the Active status and that Enable connection is set to Yes.
3. Configure your Identity Provider to send a valid email address for every User. Send first name and last name to complete the User profile.
4. Check that each existing PIM User email matches the email sent by your Identity Provider. Correct any differences before users sign in.
5. Send the relevant Identity Provider groups if you use Mapping Rules to assign PIM User Roles and User Groups.
6. Sign in with a test identity that does not already have a PIM account, then confirm that the new User appears in the PIM with the expected profile and access.
7. Test provisioning and mapping with representative IdP users before enabling automatic redirect.