> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Just-in-time (JIT) Provisioning 

> Configure just-in-time user provisioning to automatically create user accounts during first-time authentication.

## JIT Provisioning on Curator

When Curator is configured to authenticate against an external identity provider (SAML, OIDC/OAuth, Tableau Server, or
Power BI), a Frontend User account is created automatically the first time a user successfully signs in. This removes the
need for self-service registration: as long as the user can authenticate with the upstream provider, Curator provisions
the matching local account on demand.

If you'd rather restrict access to users that have been created manually in advance, this behavior can be disabled.
Navigate to **Settings** > **Security** > **Authentication Settings**, expand the **Customization** section, enable
*Disable Just-in-time Provisioning of Curator Users*, and click the "Save" button. With this setting enabled, SSO logins
will only succeed for users who already exist in **Frontend Users**.

## JIT Provisioning on Tableau

Curator can also serve as an intermediary to that process and automatically create the users on Tableau Server after a
successful authentication with Okta or other SAML identity providers.  You will still be required to manually assign any
groups, or license levels (Explorer by default), in Tableau Server.  But this allows simple authentication into Curator if
the user does not yet exist on Tableau.
(/setup/authentication/okta\_saml)
To enable this, complete the steps for SAML setup ([instructions here](/setup/authentication/okta_saml))

Then on the backend under **Settings** > **Security** > **Authentication Settings**, open up the **SAML Advanced** section
and enable *Just-in-time (JIT) Provisioning* then Save your SAML settings.

## Licensing Unlicensed Users on Login

Curator can automatically license a Tableau user who exists on Tableau Server/Cloud but has no assigned role (Unlicensed).
When *License Unlicensed Users on Login* is enabled under **Authentication Settings**, Curator will assign the configured
JIT site role to the user on their next login.

### Tableau Group Minimum Site Roles

If a user belongs to one or more Tableau groups that have a **minimum site role** configured, Tableau will reject any
attempt to assign a role lower than that minimum. When this situation is detected, Curator automatically uses the highest
group minimum site role across all of the user's group memberships instead of the configured JIT role.

For example: if the JIT role is set to *Viewer* but the user belongs to a group whose minimum site role is *Explorer*,
Curator will license the user as *Explorer*.

When Curator raises the role in this way, an informational entry is written to the application log explaining which
user was affected, what the configured JIT role was, and what effective role was applied. Check
`storage/logs/system-YYYY-MM-DD.log` if you expect this to be happening and want to confirm the behavior.