Setting Home Group to Null for auto-provisioned users

[kurtyran]

Hi, We recently implemented SAML 2.0 Single Sign On (SSO) for our Workfront instance. This has been great for allowing people in of our organization to submit requests to our various queues without having to set each one up ahead of time. However, I recently noticed that a Home Group (which, for us, generally maps to a person's department) was being assigned to each user that gets auto-provisioned. There is no attribute mapping set up for Home Group and I don't see a way under the Groups section in the Setup area to define a Primary group (the way you can with a Company), so I don't know how the system is deciding which Home Group to assign. Naturally, the Home Group/department being assigned is inaccurate for most users. In the Map User Attributes section under SSO setup, is there a way to map the Home Group the Default Value field to NULL? (And is that the best way to address this problem?). I couldn't find any guidance for this in Workfront Help. Best, Kurt Heimbigner Sr. Director of Integrated Marketing & Web Communications Gonzaga University

[ShellyLo]

Kurt, I noticed the same thing at my previous company. I was never able to resolve the issue so I am hopeful someone can provide guidance. Shelly Long AVP, Customer Experience Delivery

[Angie_S]

We ran into this as well and I did a lot of research...high-level details below. The group that gets assigned by default is the first one in your Groups list. You can map Home Group in the auto-provision details, but we chose not to do so because in our testing, it was overriding a user's existing Home Group every time they logged in. Auto-provision mappings apply each time someone logs in, not just a new user. We also wanted to keep track of who was getting auto-provisioned each day so we could then assign to the appropriate business unit (we have some users who have access to "global" company queues and some who only need access to specific business units). To do this, I set up the following: A new group called *Auto-Provisioned. The * is so that it floats up to the top of the group list automatically. Every auto-provisioned user is then automatically assigned to that group A report that automatically sends to me daily called "Auto-Provisioned Users" that pulls any users who have *Auto-Provisioned set as their Group. I then go through the list and determine who needs to go where. Once they are removed from the *Auto-Provisioned group, they fall off the report. Angela Simon CUNA Mutual Group

[VicAl]

This probably doesn't help, but we created an integration using the API that ties to PeopleSoft. This allows us to provision people with whatever information we want (Home Group (Division for us), Phone number, Title, and other fields). We also have it set up to perform the Deactivations in WF as they get deactivated in PeopleSoft. Both of these save me (as the Admin) a TON of time as I never have to create or deactivate people in WF. As such we basically disconnected the Auto provision with Workfront. I know it doesn't help if you don't use the API or have access to someone that can code it for you. But it didn't take too long to code and as I mentioned it's a huge time saver. So it might be worth the investigation. Vic Alejandro, PMP, CSM | IT Program Manager Denver Water | t: (303-628-7262) | c: (303-319-6473) "http://www.denverwater.org/"> http://www.denverwater.org INTEGRITY | VISION | PASSION | EXCELLENCE | RESPECT