You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: en/includes/guides/organization-management/organization-discovery/email-domain-based-organization-discovery.md
+23-22Lines changed: 23 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -84,40 +84,41 @@ In this example scenario:
84
84
85
85
When you map an email domain to an organization, the organization's behavior changes as follows:
86
86
87
-
<!-- markdownlint-disable MD007 -->
88
-
- A user can only onboard to the organization if the user's email domain matches one of the domains claimed by the organization.
89
-
{% if product_name == "Asgardeo" or (product_name == "WSO2 Identity Server" and is_version == "7.0.0") %}
90
-
- Just-In-Time (JIT) provisioning during federated authentication only occurs if the user's email domain matches one of the domains claimed by the organization.
87
+
- A user can only onboard to the organization if the user's email domain matches one of the domains claimed by the organization.
91
88
92
-
!!! warning "Map subject attribute for JIT provisioning"
93
-
In **OIDC** and **SAML** applications, the subject uniquely identifies the user.
89
+
{% if product_name == "Asgardeo" or (product_name == "WSO2 Identity Server" and is_version == "7.0.0") %}
94
90
95
-
If your organization uses email domain-based organization discovery, make sure to map the subject attribute correctly as explained below:
91
+
- Just-In-Time (JIT) provisioning during federated authentication only occurs if the user's email domain matches one of the domains claimed by the organization.
96
92
97
-
- Set the email attribute as the subject attribute i.e. `http://wso2.org/claims/emailaddress`.
98
-
- Map the email attribute from the external identity provider to the same WSO2 claim: `http://wso2.org/claims/emailaddress`.
93
+
!!! warning "Map subject attribute for JIT provisioning"
94
+
In **OIDC** and **SAML** applications, the subject uniquely identifies the user.
99
95
100
-
**Why this matters**: Domain-based organization discovery relies on email addresses to identify organizations. Mapping the subject attribute to the email claim ensures that Just-in-Time (JIT) provisioning creates and updates users correctly.
96
+
If your organization uses email domain-based organization discovery, make sure to map the subject attribute correctly as explained below:
101
97
102
-
Learn more about selecting [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-oidc-app/#select-an-alternate-subject-attribute) for OIDC applications and [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-saml-app/#select-the-subject-attribute) for SAML applications.
98
+
- Set the email attribute as the subject attribute i.e. `http://wso2.org/claims/emailaddress`.
99
+
- Map the email attribute from the external identity provider to the same WSO2 claim: `http://wso2.org/claims/emailaddress`.
103
100
104
-
{% else %}
105
-
- The system restricts federated authentication and Just-In-Time (JIT) provisioning for users logging in with email domains not claimed by the organization.
101
+
**Why this matters**: Domain-based organization discovery relies on email addresses to identify organizations. Mapping the subject attribute to the email claim ensures that Just-in-Time (JIT) provisioning creates and updates users correctly.
106
102
107
-
!!! warning "Map subject attribute for JIT provisioning and federated authentication"
108
-
In **OIDC** and **SAML** applications, the subject uniquely identifies the user.
103
+
Learn more about selecting [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-oidc-app/#select-an-alternate-subject-attribute) for OIDC applications and [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-saml-app/#select-the-subject-attribute) for SAML applications.
109
104
110
-
If your organization uses email domain-based organization discovery, make sure to map the subject attribute correctly as explained below:
105
+
{% else %}
111
106
112
-
- Set the email attribute as the subject attribute i.e. `http://wso2.org/claims/emailaddress`.
113
-
- Map the email attribute from the external identity provider to the same WSO2 claim: `http://wso2.org/claims/emailaddress`.
107
+
- The system restricts federated authentication and Just-In-Time (JIT) provisioning for users logging in with email domains not claimed by the organization.
114
108
115
-
**Why this matters**: Domain-based organization discovery relies on email addresses to identify organizations. Mapping the subject attribute to the email claim ensures smooth federated authentication and Just-in-Time (JIT) provisioning creates and updates users correctly.
109
+
!!! warning "Map subject attribute for JIT provisioning and federated authentication"
110
+
In **OIDC** and **SAML** applications, the subject uniquely identifies the user.
116
111
117
-
Learn more about selecting [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-oidc-app/#select-an-alternate-subject-attribute) for OIDC applications and [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-saml-app/#select-the-subject-attribute) for SAML applications.
112
+
If your organization uses email domain-based organization discovery, make sure to map the subject attribute correctly as explained below:
118
113
119
-
{% endif %}
120
-
<!-- markdownlint-enable MD007: othervise the sub bullet points are not rendered properly. -->
114
+
- Set the email attribute as the subject attribute i.e. `http://wso2.org/claims/emailaddress`.
115
+
- Map the email attribute from the external identity provider to the same WSO2 claim: `http://wso2.org/claims/emailaddress`.
116
+
117
+
**Why this matters**: Domain-based organization discovery relies on email addresses to identify organizations. Mapping the subject attribute to the email claim ensures smooth federated authentication and Just-in-Time (JIT) provisioning creates and updates users correctly.
118
+
119
+
Learn more about selecting [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-oidc-app/#select-an-alternate-subject-attribute) for OIDC applications and [selecting the subject attribute]({{base_path}}/guides/authentication/user-attributes/enable-attributes-for-saml-app/#select-the-subject-attribute) for SAML applications.
120
+
121
+
{% endif %}
121
122
122
123
- If not, a user can register to the organization with an email address of any domain (other than the domains claimed by other organizations).
0 commit comments