JIT (Just-in-Time) provisioning allows new users to be automatically created in Hudu when they first log in via SSO — no manual setup required.
This guide walks through enabling JIT provisioning in Hudu.
Prerequisites
- SAML SSO must already be configured between Hudu and your Identity Provider (IdP).
- Super Admin access in Hudu.
- Administration abilities within your IdP.
Enabling JIT Provisioning in Hudu
- In Hudu, go to Admin → Security → Configure SAML/SSO.
- Scroll to the bottom and toggle JIT Provisioning.
- Set your desired:
- Default role for users created via JIT
- Group(s)
Default Role
This sets the user’s role when:
- No valid
hudu_user_roleattribute is provided. - A
hudu_user_roleclaim exists but contains an unsupported value.
Default Group(s)
Provisioned Spectator and Editor users are added to the selected Group(s). Group selection is not required when the default (or claimed) role is Admin or Super Admin — those roles do not rely on group membership for access.
Role and group membership are set only at user creation. Later changes to claims or JIT defaults are not applied on subsequent SSO logins.
Ensure SSO Assignment in Identity Provider
Users must be assigned to the Hudu SSO application inside your identity provider (IdP).
Once assigned, users will be automatically provisioned the first time they log in via SSO.
Configuring Role-Based Claims
To assign roles from your IdP, send a SAML attribute/claim named exactly hudu_user_role.
Claim name
- Name:
hudu_user_role(must match exactly).
Claim values
Map each IdP group or role condition to one of the following values (case-insensitive):
| Hudu Role | Claim Value |
|---|---|
| Spectator | spectator |
| Editor | editor |
| Admin | admin |
| Super Admin | super_admin |
portal_user is not an acceptable claim value. If you attempt
to assign it, the user is created with your JIT default role instead.
Save the claim in your IdP after configuring any group/role conditions.
Notes and Gotchas
- Propagation Delay: Changes to claim configuration in your IdP may take ~30 seconds to take effect.
- Conflicting Role Mappings: Prefer a single clear
hudu_user_rolevalue per user. If a user matches multiple IdP conditions with different roles, the IdP may send an unexpected value. Missing Names: If a user does not have a first and last name in the IdP (via the standard given name / surname claims), they will appear in Hudu as:
First Name: Provisioned
Last Name: User
Final Test
After setup:
- Assign a test user to the SSO application.
- Ensure they receive only one intended
hudu_user_rolevalue. - Try logging in via SSO.
- Verify the role and group assigned in Hudu.
If login and provisioning succeed with the correct role/group assignment — you're all set!
FAQ
Answer: Yes. For JIT provisioning, map a SAML attribute/claim named hudu_user_role to one of the supported role values above. Names can also be passed via standard given name and surname claims. Role and group assignment happen only when the user is first created.