SSO-Based Auto-Provisioning & Group Assignment in Ondexx

Overview

Ondexx supports user account auto-provisioning during first-time login via SSO. To extend this functionality, organizations can optionally pass a claim named Groups to automatically assign users to predefined Usergroups within Ondexx.

How It Works

• When a new user signs in via SSO for the first time, Ondexx will automatically provision their account.
• If the SSO token includes a Groups claim, Ondexx will attempt to match each group name against existing Usergroups in any Sites to which the user has access.
• If a match is found, the user will be added to the matching Usergroup(s).

Important Conditions

• The Usergroup must already exist in the relevant Site(s).
• No Usergroups are created dynamically.
• If no match is found, the value is ignored silently — no errors or warnings are shown to the user or admin.
• All such events are recorded in the instance event log, accessible to administrators.

Best Practices

To ensure a seamless experience:

1. Pre-create all Usergroups in the appropriate Sites.
2. Assign Rights and Permissions to those Usergroups.
3. Validate the exact group name spelling in both the IdP claim and Ondexx Site.

Recommendation

We strongly recommend using the Ondexx REST API — which includes full SCIM support — to manage users and group assignments in a controlled and auditable way. This provides greater flexibility, transparency, and automation for IAM teams.