Auto-provision users via SSO using SAML 2.0 | Community
Skip to main content
P
PeggySe1
Level 2
June 7, 2016
Question

Auto-provision users via SSO using SAML 2.0

  • June 7, 2016
  • 12 replies
  • 1815 views
According to this bit of informaiton (https://support.workfront.com/hc/en-us/articles/217194907) you can set SSO to auto-provision new users if they exist in your LDAP but not in Workfront. My questions are: Is anyone using this and what has been your experience? Pros/cons? What attribute does it check to see if the user exists or not? I'm assuming the Federation ID but I cannot confirm that anywhere in Help, anyway. Thanks! :)
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

12 replies

E
EricLu2
Level 10
June 7, 2016
Hi: If you have no limit to the number of licenses you have, this might be interesting. I have to believe the setup work must be done - either in LDAP or in WorkFront. I suspect even if you use auto-provision, you’ll have to go into WorkFront and add/clean-up stuff for auto-provisioned users. No, we don’t use it. We have a fixed number of licenses. It might be neat to use for Business users (REVIEW license), but I didn’t see where you could autoprovision one type of user but not another. Let’s see if anyone autoprovisions. This will be an interesting discussion topic. Eric ________________________________
P
PeggySe1Author
Level 2
June 8, 2016
I saw a reply to this outside of this thread, so I'm going to reply here to see if we can keep the conversation on the thread. I would hope that auto-provision would assign the user with a collaboration/reviewer license, then if needed, the admin would assign a paid license once the account was created. This is just an option that we're exploring at this point.
E
EricLu2
Level 10
June 8, 2016
Hi: You can map an attribute in your LDAP to WorkFront. You edit the SSO settings, scroll down and select Attribute Mapping. You have to have loaded the XML DDL (I think that is what it is called) so that you can map the WorkFront Attribute Access Level to the attribute in your LDAP. You should map as many attributes as you can to reduce the admin work required after the ID is created. [cid:image001.jpg@01D1C160.070515D0] I’m sure you’ve already seen this help file entry, but for everyone else, the mapping of attributes is described here: https://support.workfront.com/hc/en-us/articles/217194907-Configuring-Workfront-with-SAML-2-0 They have examples of mapping attributes too. Hope this helps. Eric
N
NateBa
Level 9
June 8, 2016
Peggy, for some reason Eric's posts were posting outside the thread. I've moved them back in so that you (and others reading the conversation) don't get lost. Not sure why that happened. I'll keep an eye out for it as/if the conversation continues. In Reply to Peggy Settel:
I saw a reply to this outside of this thread, so I'm going to reply here to see if we can keep the conversation on the thread. I would hope that auto-provision would assign the user with a collaboration/reviewer license, then if needed, the admin would assign a paid license once the account was created. This is just an option that we're exploring at this point.
-Nate Bagley --- Workfront Community Manager - Work Smart, Work Happy Message me directly at:
E
EricLu2
Level 10
June 8, 2016
I’m just hitting reply. Let me know if I need to do something different… Thanks, Eric
P
PeggySe1Author
Level 2
June 9, 2016
Thanks Nate!
M
MeredithLa2
Level 2
April 27, 2017
We're setting up SSO SAML 2.0 and I want to make it so that all users get a "reviewer" license by default but can't find any guidance on what this rule is looking for. How did you set up your rule?
S
SusanPf
Level 9
April 27, 2017
I just checked with this through Workfront Help and it is not possible. Response below: This feature is working per system design. If the Auto-provisioning is enabled the system is creating "Request" License type Users and no other License type. This is designed to prevent any actions which can change the workflow by new users. Thus it won't be possible to change it to be "Reviewers".
D
DillonFi
April 27, 2017

We have this setup on our instance, we have licenses configured by job title giving everyone a reviewer license unless job title matches those that will need a plan/work license.

E
EricLu2
Level 10
April 28, 2017
You would think that there would be a way to pass in an attribute that determines the license type. I think their code is designed without considering the real world use case. Pity. Eric
Show more replies
Terms & ConditionsAccessibility statement

Loading footer...