Overview
Ondexx supports user account auto-provisioning during first-time login via SSO. To extend this functionality, organizations can optionally pass a claim named Groups to automatically assign users to predefined Usergroups within Ondexx.
How It Works
- When a new user signs in via SSO for the first time, Ondexx will automatically provision their account.
- If the SSO token includes a Groups claim, Ondexx will attempt to match each group name against existing Usergroups in any Sites to which the user has access.
- If a match is found, the user will be added to the matching Usergroup(s).
Important Conditions
- The Usergroup must already exist in the relevant Site(s).
- No Usergroups are created dynamically.
- If no match is found, the value is ignored silently — no errors or warnings are shown to the user or admin.
- All such events are recorded in the instance event log, accessible to administrators.
Best Practices
To ensure a seamless experience:
- Pre-create all Usergroups in the appropriate Sites.
- Assign Rights and Permissions to those Usergroups.
- Validate the exact group name spelling in both the IdP claim and Ondexx Site.
Recommendation
We strongly recommend using the Ondexx REST API — which includes full SCIM support — to manage users and group assignments in a controlled and auditable way. This provides greater flexibility, transparency, and automation for IAM teams.