JIT Provisioning with Salesforce

Test Salesforce's Just-in-Time provisioning by sending custom attributes, groups, and roles in the SAML assertion.

Prerequisites

Complete the Salesforce SSO setup guide first.

1. Enable JIT in Salesforce

  1. In Setup → Single Sign-On Settings, edit your SSO configuration.
  2. Check "User Provisioning Enabled" (Just-in-Time).
  3. Save.

2. Configure personas with attributes

  1. In your realm's directory, edit a persona or create a new one.
  2. Add custom attributes that Salesforce expects for JIT. The standard ones:
    • User.Username
    • User.Email
    • User.FirstName
    • User.LastName
    • User.ProfileId — the 15/18-char Salesforce profile ID
  3. Assign groups and roles to the persona if you want to test those mappings.
  4. On the SAML tab, enable the groups and/or roles attribute toggles and set their attribute names to match what Salesforce expects.

3. Test JIT provisioning

  1. Trigger SSO from Salesforce and pick the persona with JIT attributes.
  2. If the user doesn't exist in Salesforce yet, JIT should create them using the attributes from the assertion.
  3. Check the new user in Salesforce — verify that the profile, name, email, and any other attributes were provisioned correctly.

4. What to look for

start testing →