---
title: "SSO - Just in Time"
slug: "sso-just-in-time-1"
updated: 2026-10-29T17:05:25Z
published: 2026-10-29T17:05:25Z
canonical: "wiki.cobblestonesoftware.com/sso-just-in-time-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.cobblestonesoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO - Just in Time

**COBBLESTONE SOFTWARE**

Contract Insight — User Guide

**SSO - Just in Time**

*Single Sign-On › Single Sign On Configuration › SSO - Just in Time*

**Note:** Each procedure in this guide begins at the Contract Insight homepage, so any section can be followed on its own. Custom fields are configurable, so the exact field list on a contract category record may vary between environments.

# 1. Overview

Just-in-time (JIT) provisioning is configured per SSO configuration by clicking its dedicated icon in the SSO Configurations table on Administration > Single Sign-On, which opens a **Just-In-Time Provisioning** screen scoped to that one configuration (for example, "For the 'Blackbox SSO' SSO configuration"). Its Settings section has five toggles: **Create users (JIT)** (automatically create a Contract Insight account when someone the identity provider recognizes signs in but no matching account exists — off by default in this environment); **Update users (JIT)** (automatically update an existing account's details from a matching definition when its owner signs back in after being disabled/removed — on); **Overwrite security groups on update** (replace, rather than add to, the account's group memberships on update — off); **Trim whitespace** (ignore leading/trailing spaces when comparing identity-provider values against a condition — on); and **Case-insensitive comparisons** (ignore letter case when matching, e.g. "Sales" matches "sales" — off). Below Settings, a **Definitions** section is where a definition decides, from conditions on the incoming identity-provider data, whether to create or update an account and how to fill it in — the most common setup uses two **definitions**, one broader for creating a new account and a more limited one for updating an existing one.

# 2. Key Elements

- Reached from the SSO Configurations table's **Just-in-time provisioning** icon, scoped to one named SSO configuration.
- Five toggles: **Create users (JIT)**, **Update users (JIT)**, **Overwrite security groups on update**, **Trim whitespace**, and **Case-insensitive comparisons**.
- A **Definitions** section below Settings maps identity-provider data conditions to account-creation/update behavior — typically one definition for creating accounts and a separate, more limited one for updating them.

# 3. Navigating to Single Sign-On

1. From the Contract Insight homepage, click the **Administration** icon at the bottom of the left navigation bar.
2. In the **Search administration** box, type **sign-on**, or scroll to the **Security & Access** category.
3. Click **Single Sign-On**.

![Administration page filtered to Single Sign-On](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-01-admin-sso.jpg)

# 4. Opening Just-In-Time Provisioning

1. On the **Single Sign-On** page, scroll down to **SSO Configurations**.
2. Find the SSO configuration to provision users for. Use **Add configuration** first if none exists.
3. Click the **Just-in-time provisioning for this configuration** icon (person icon) on that configuration's row.

![SSO Configurations table with Add configuration and the Just-in-time provisioning icon highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-02-sso-configs.jpg)

The **Just-In-Time Provisioning** screen opens. The subtitle names the SSO configuration it applies to.

# 5. Configuring JIT Settings

1. In the **Settings**section, turn each toggle on or off as needed:
  - **Create users (JIT)**: create a new account when a recognized user signs in without one.
  - **Update users (JIT)**: update an existing account from a matching definition when its owner signs back in.
  - **Overwrite security groups on update**: replace group memberships on update instead of adding to them.
  - **Trim whitespace**: ignore leading and trailing spaces when comparing values.
  - **Case-insensitive comparisons**: ignore letter case when matching values.
2. Click **Save Settings**.

![Just-In-Time Provisioning Settings with the configuration subtitle, five toggles, and Save Settings highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-03-settings.jpg)

# 6. Managing Definitions

## 6a. Viewing and Adding Definitions

1. Scroll to the **Definitions** section below Settings.
2. Review existing definitions. The grid shows whether each is **Enabled** and whether it can **Allow Insert** (create accounts) and **Allow Update** (update accounts).
3. Click **Add Definition** to create a new one, or **Edit** on a row to change an existing one. Use the delete icon to remove a definition.

![Definitions section with Add Definition, Enabled, Allow Insert, Allow Update, Edit, and delete highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-04-definitions.jpg)

## 6b. Setting a Definition's Options and Conditions

1. In the **JIT Definition** panel, enter a **Name**.
2. Set **Enabled**, **Use when creating accounts**, and **Use when updating accounts**.
3. On the **Conditions** tab, choose the identity-provider value (for example, **Name ID**), an operator (for example, **Equals**), and enter the attribute name and the value to compare against. Click **+ Condition** to add more. All conditions must match before the definition is used; leave them empty to always apply.

![JIT Definition panel with Name, Enabled, creating and updating toggles, tabs, condition fields, Condition, Cancel, and Save highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-05-definition-conditions.jpg)

## 6c. Mapping Account Fields

1. Click the **Field Map** tab.
2. Click **+ Field Map**, choose the identity-provider value in the first drop-down, and choose the account field to fill in **Choose a field**. Enter the attribute name if the source needs one. Use the delete icon to remove a mapping.

![Field Map tab with source and target field drop-downs, attribute box, remove icon, Field Map, and Save highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-06-field-map.jpg)

**Note:** Mapping to a reference field (such as a department) needs the underlying record's ID, not its display text.

## 6d. Assigning Security Groups

1. Click the **Security Groups** tab.
2. Select a group from **Choose a security group** and click **Add Assignment**. Each assignment can have its own conditions, checked independently of the definition's conditions.
3. Click **Save** to save the definition, or **Cancel** to discard changes.

![Security Groups tab with the security group drop-down, Add Assignment, and Save highlighted](https://cdn.document360.io/e3626857-1fb5-4e27-b278-2d3fc5508be4/Images/Documentation/jit-07-security-groups.jpg)

**Note:** The most common setup uses two definitions: a broader one for creating new accounts and a more limited one for updating existing accounts (names, titles, email).

# 7. Quick Reference Summary

| Task | How to Complete It |
| --- | --- |
| Open Single Sign-On | **Administration** → search **sign-on** → **Single Sign-On**. |
| Open JIT for a configuration | **SSO Configurations** → **Just-in-time provisioning** icon on the row. |
| Turn account creation or updates on/off | **Settings** → toggles → **Save Settings**. |
| Add a definition | **Definitions** → **Add Definition** → set options → **Save**. |
| Limit when a definition applies | Definition → **Conditions** tab → **+ Condition**. |
| Fill account fields from the IdP | Definition → **Field Map** tab → **+ Field Map**. |
| Assign security groups | Definition → **Security Groups** tab → choose a group → **Add Assignment**. |