Skip to main content

​
JIT Provisioning on Curator

When Curator is configured to authenticate against an external identity provider (SAML, OIDC/OAuth, Tableau Server, or Power BI), a Frontend User account is created automatically the first time a user successfully signs in. This removes the need for self-service registration: as long as the user can authenticate with the upstream provider, Curator provisions the matching local account on demand. If you’d rather restrict access to users that have been created manually in advance, this behavior can be disabled. Navigate to Settings > Security > Authentication Settings, expand the Customization section, enable Disable Just-in-time Provisioning of Curator Users, and click the “Save” button. With this setting enabled, SSO logins will only succeed for users who already exist in Frontend Users.

​
JIT Provisioning on Tableau

Curator can also serve as an intermediary to that process and automatically create the users on Tableau Server after a successful authentication with Okta or other SAML identity providers. You will still be required to manually assign any groups, or license levels (Explorer by default), in Tableau Server. But this allows simple authentication into Curator if the user does not yet exist on Tableau. (/setup/authentication/okta_saml) To enable this, complete the steps for SAML setup (instructions here) Then on the backend under Settings > Security > Authentication Settings, open up the SAML Advanced section and enable Just-in-time (JIT) Provisioning then Save your SAML settings.

​
Licensing Unlicensed Users on Login

Curator can automatically license a Tableau user who exists on Tableau Server/Cloud but has no assigned role (Unlicensed). When License Unlicensed Users on Login is enabled under Authentication Settings, Curator will assign the configured JIT site role to the user on their next login.

​
Tableau Group Minimum Site Roles

If a user belongs to one or more Tableau groups that have a minimum site role configured, Tableau will reject any attempt to assign a role lower than that minimum. When this situation is detected, Curator automatically uses the highest group minimum site role across all of the user’s group memberships instead of the configured JIT role. For example: if the JIT role is set to Viewer but the user belongs to a group whose minimum site role is Explorer, Curator will license the user as Explorer. When Curator raises the role in this way, an informational entry is written to the application log explaining which user was affected, what the configured JIT role was, and what effective role was applied. Check storage/logs/system-YYYY-MM-DD.log if you expect this to be happening and want to confirm the behavior.