COBBLESTONE SOFTWARE

Contract Insight — User Guide

SSO - Just in Time

Single Sign-On › Single Sign On Configuration › SSO - Just in Time

Note: Each procedure in this guide begins at the Contract Insight homepage, so any section can be followed on its own. Custom fields are configurable, so the exact field list on a contract category record may vary between environments.

1. Overview

Just-in-time (JIT) provisioning is configured per SSO configuration by clicking its dedicated icon in the SSO Configurations table on Administration > Single Sign-On, which opens a Just-In-Time Provisioning screen scoped to that one configuration (for example, "For the 'Blackbox SSO' SSO configuration"). Its Settings section has five toggles: Create users (JIT) (automatically create a Contract Insight account when someone the identity provider recognizes signs in but no matching account exists — off by default in this environment); Update users (JIT) (automatically update an existing account's details from a matching definition when its owner signs back in after being disabled/removed — on); Overwrite security groups on update (replace, rather than add to, the account's group memberships on update — off); Trim whitespace (ignore leading/trailing spaces when comparing identity-provider values against a condition — on); and Case-insensitive comparisons (ignore letter case when matching, e.g. "Sales" matches "sales" — off). Below Settings, a Definitions section is where a definition decides, from conditions on the incoming identity-provider data, whether to create or update an account and how to fill it in — the most common setup uses two definitions, one broader for creating a new account and a more limited one for updating an existing one.

2. Key Elements

• Reached from the SSO Configurations table's Just-in-time provisioning icon, scoped to one named SSO configuration.
• Five toggles: Create users (JIT), Update users (JIT), Overwrite security groups on update, Trim whitespace, and Case-insensitive comparisons.
• A Definitions section below Settings maps identity-provider data conditions to account-creation/update behavior — typically one definition for creating accounts and a separate, more limited one for updating them.

3. Navigating to Single Sign-On

1. From the Contract Insight homepage, click the Administration icon at the bottom of the left navigation bar.
2. In the Search administration box, type sign-on, or scroll to the Security & Access category.
3. Click Single Sign-On.

4. Opening Just-In-Time Provisioning

1. On the Single Sign-On page, scroll down to SSO Configurations.
2. Find the SSO configuration to provision users for. Use Add configuration first if none exists.
3. Click the Just-in-time provisioning for this configuration icon (person icon) on that configuration's row.

The Just-In-Time Provisioning screen opens. The subtitle names the SSO configuration it applies to.

5. Configuring JIT Settings

1. In the Settingssection, turn each toggle on or off as needed:
   • Create users (JIT): create a new account when a recognized user signs in without one.
   • Update users (JIT): update an existing account from a matching definition when its owner signs back in.
   • Overwrite security groups on update: replace group memberships on update instead of adding to them.
   • Trim whitespace: ignore leading and trailing spaces when comparing values.
   • Case-insensitive comparisons: ignore letter case when matching values.
2. Click Save Settings.

6. Managing Definitions

6a. Viewing and Adding Definitions

1. Scroll to the Definitions section below Settings.
2. Review existing definitions. The grid shows whether each is Enabled and whether it can Allow Insert (create accounts) and Allow Update (update accounts).
3. Click Add Definition to create a new one, or Edit on a row to change an existing one. Use the delete icon to remove a definition.

6b. Setting a Definition's Options and Conditions

1. In the JIT Definition panel, enter a Name.
2. Set Enabled, Use when creating accounts, and Use when updating accounts.
3. On the Conditions tab, choose the identity-provider value (for example, Name ID), an operator (for example, Equals), and enter the attribute name and the value to compare against. Click + Condition to add more. All conditions must match before the definition is used; leave them empty to always apply.

6c. Mapping Account Fields

4. Click the Field Map tab.
5. Click + Field Map, choose the identity-provider value in the first drop-down, and choose the account field to fill in Choose a field. Enter the attribute name if the source needs one. Use the delete icon to remove a mapping.

Note: Mapping to a reference field (such as a department) needs the underlying record's ID, not its display text.

6d. Assigning Security Groups

6. Click the Security Groups tab.
7. Select a group from Choose a security group and click Add Assignment. Each assignment can have its own conditions, checked independently of the definition's conditions.
8. Click Save to save the definition, or Cancel to discard changes.

Note: The most common setup uses two definitions: a broader one for creating new accounts and a more limited one for updating existing accounts (names, titles, email).

7. Quick Reference Summary