Implement just-in-time user provisioning

APIs for just-in-time provisioning

AEM forms provides the following APIs for just-in-time provisioning:

package com.adobe.idp.um.spi.authentication  ;
publ ic interface IdentityCreator {
/**
* Tries  to create a user with the  in formation  provided in the <code>UserProvisioningBO</code> object.
* If the user is successfully created, a valid AuthResponse is returned along with the information using which the user was created.
* It is the responsibility of the IdentityCreator to set the User obje ct  in the cre dential map with th e  ke y  <code>UMA u thenticationUtil.authenticatedUserKey</code>
* The credentials are available in the <code>UserProvisioningBO</code> object in the 'credentials' property.
* If the IdentityCreator is unable to create a user due to any reason, it returns <code>null</code>
* @param userBO An object of <code>com.adobe. i dp.um . spi.authenti c ationUserProvisioningBO</code>
* @return */public AuthResponse create(UserProvisioningBO userBO);
/**
* Returns the name of the IdentityCreator which will be registered in preferences.
* This name is used to associate the IdentityProvider with the Auth Provider Configuration in the domain.
* @return The name of the Identity Creator which is recognized in Configuration.
*/
public String getName();
}
package com.adobe.idp.um.spi.authentication;
import com.adobe.idp.um.api.infomodel.User;
public interface AssignmentProvider {
/**
* Tries to assign roles or permissions or group memberships to users created via Just-in-time provisioning.
* @param user The User created via the Just-in-time provisioning process.
* @return a Boolean flag indicating whether the assignment was successful or not.
*/
public Boolean assign(User user);
/**
* Returns the name of the AssignmentProvider through which it is registered under preferences.
* This name is used to associate the AssignmentProvider with the Auth Provider Configuration in the domain.
* @return The name of the AssignmentProvider which is recognized in Configuration.
*/public String getName();
}

Considerations while creating a just-in-time-enabled domain

  • While creating a custom IdentityCreator for a hybrid domain, ensure that a dummy password is specified for the local user. Do not leave this password field empty.
  • Recommendation: Use DomainSpecificAuthentication to validate user credentials against a specific domain.

Create a just-in-time-enabled domain

  1. Write a DSC implementing the APIs in the “APIs for just-in-time provisioning” section.

  2. Deploy the DSC to the Forms Server.

  3. Create a just-in-time-enabled domain:

    • In Administration Console, click Settings > User Management > Domain Management > New Enterprise Domain.
    • Configure the domain and select Enable Just In Time Provisioning.
    • Add authentication providers. While adding authentication providers, on the New Authentication screen, select a registered Identity Creator and Assignment Provider.
  4. Save the new domain.

Behind the scenes

Assume that a user is trying to log in to AEM forms and an authentication provider accepts their user credentials. If the user doesn’t yet exist in the User Management database, the identity check for the user fails. AEM forms now performs the following actions:

  1. Create a UserProvisioningBO object with the authentication data and place it in a credential map.
  2. Based on domain information returned by UserProvisioningBO, fetch and invoke the registered IdentityCreator and AssignmentProvider for the domain.
  3. Invoke IdentityCreator. If it returns a successful AuthResponse, extract UserInfo from the credential map. Pass it to the AssignmentProvider for group/role assignment and any other post-processing after the user is created.
  4. If the user is created successfully, return the login attempt by the user as successful.
  5. For hybrid domains, pull user information from the authentication data provided to the authentication provider. If this information is fetched successfully, create the user on-the-fly.
NOTE
The just-in-time provisioning feature ships with a default implementation of IdentityCreator that you can use to dynamically create users. Users are created with the information associated with the directories in the domain.

Experience Manager


Espressos & Experience Manager: AEM Forms

Espressos & Experience Manager

Thursday, Mar 6, 7:00 PM UTC

Join Adobe's AEM product team as they highlight AEM Forms' latest innovations, including: the new Gen AI Assistant, Unified Composition with AEM Sites, and new ways to deploy forms through conversations.

Register

Rapid Feature Releases with AEM Cloud: Telegraph Media Group’s RDE Strategy

Online | Session | Intermediate

Hear how Telegraph Media Group, the award-winning publisher of The Daily Telegraph, The Sunday Telegraph, The Telegraph Magazine,...

Wed, Mar 19, 3:30 PM PDT (10:30 PM UTC)

Register

Put the Customer at the Center and Build Relationships That Last a Lifetime

Online | Strategy Keynote | General Audience

First impressions last a lifetime. Great first impressions feel personal, connected, and relevant right from the start. From the first...

Wed, Mar 19, 2:30 PM PDT (9:30 PM UTC)

Register

Connect with Experience League at Summit!

Get front-row access to top sessions, hands-on activities, and networking—wherever you are!

Learn more