Configure Just-in-Time Provisioning – Yext Help

Just-in-Time (JIT) provisioning automates user account creation for web applications using SAML (Security Assertion Markup Language). When a new user logs in to an authorized app for the first time, JIT provisioning uses information passed from the identity provider to create their account automatically.

Note: JIT provisioning requires SAML SSO. See Configure SAML SSO if you haven't set this up yet.

How Just-in-Time SAML Provisioning Works

With JIT provisioning, a SAML assertion triggers the creation of a user the first time they log in to Yext with single sign-on (SSO).

A SAML response can include an Attribute Statement containing the attributes needed to create a new user, including their name and the access they should have.
If a SAML login request is valid but refers to a user who doesn't yet exist in the account, Yext creates a new user, provided the SAML response includes sufficient attributes.
If the user already exists, Yext uses any supplied attributes to update the user, for example, to update their name. If the SAML response supplies Access Control List (ACL) entries, those entries completely replace the user's current ACL entries.

Turn On Just-in-Time Provisioning

Click the profile icon at the bottom of the navigation bar.
Click Account Settings, then click SAML Configuration.
Click Just in Time Provisioning, select On, and click Save.

Supported Attributes

JIT provisioning supports the following attributes:

Attribute	Meaning
`firstName`	The user's first name.
`lastName`	The user's last name.
`emailAddress`	The user's email address.
`phoneNumber`	The user's phone number.
`acl[n].roleId`	The role ID for an ACL (Access Control List) entry to grant the user. All other ACL entries are cleared if the user already exists.
`acl[n].on`	The ID of the account, folder, or location the ACL entry grants access to.
`acl[n].onType`	One of `ACCOUNT`, `FOLDER`, or `LOCATION`.

If you supply any ACL attribute for a given n, you must supply all of them. A supplied list of ACL entries is treated as exhaustive and replaces the user's existing ACL entries, unless the entries are identical.

This follows the pattern of the User object in the API, except that the following fields aren't supported in JIT provisioning:

id
username, since that's supplied in the NameID of the Subject
sso, which is always set to true when a user successfully authenticates via SAML with JIT provisioning on

SAML Response Format for Just-in-Time Provisioning

Attributes describing the user are supplied through an AttributeStatement.

<samlp:Response ID="_257f9d9e9fa14962c0803903a6ccad931245264310738"
   IssueInstant="2009-06-17T18:45:10.738Z" Version="2.0">
   <saml:Subject>
      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
         lsmith@customer.net
      </saml:NameID>
   </saml:Subject>
   <saml:AttributeStatement>
      <saml:Attribute Name="firstName">
         <saml:AttributeValue xsi:type="xs:anyType">Lucy</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="lastName">
         <saml:AttributeValue xsi:type="xs:anyType">Smith</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="emailAddress">
         <saml:AttributeValue xsi:type="xs:anyType">lsmith@customer.net</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="acl[0].roleId">
         <saml:AttributeValue xsi:type="xs:anyType">43834</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="acl[0].on">
         <saml:AttributeValue xsi:type="xs:anyType">349838474</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="acl[0].onType">
         <saml:AttributeValue xsi:type="xs:anyType">ACCOUNT</saml:AttributeValue>
      </saml:Attribute>
   </saml:AttributeStatement>
</samlp:Response>