Lion Cipher Lab
Create users the moment they sign in: Just-in-Time provisioning with Keycloak identity brokering
- Identity & Access Management
- Intermediate
- ~50 min
- Free · no account required
Why it matters
When you federate an application to an external identity provider, a brand-new person has no account in that application the very first time they sign in — so something has to create one. There are only two ways to do it, and knowing which to reach for is a real, interview-grade judgement. PUSH provisioning (SCIM) has the identity provider create accounts in the app AHEAD of time, and — crucially — deactivate them when the person leaves. PULL provisioning, better known as Just-in-Time or JIT, has the application create the account ON THE FLY at first successful login, reading the person's…
What you'll learn
- Just-in-Time (JIT) user provisioning
- OIDC identity brokering
- OpenID Connect discovery and the well-known endpoint
- First Login Flow and identity provider Sync Mode (import / force / legacy)
- Identity Provider Mappers (claim-to-role, attribute importer)
- mapping upstream group claims to local roles
- recognising the JIT deprovisioning gap (orphaned accounts)
- choosing between push (SCIM) and pull (JIT) provisioning
Steps in this lab
- From zero: the first-login problem, and the two ways to solve it
- What you are about to build, and why it is two realms
- Start Keycloak in Docker
- Build the upstream IdP: a realm, a user, and a group to map later
- Register the broker as an OIDC client of the upstream IdP
- Find the discovery URL — the one link that wires two realms together
- In the broker realm: add the upstream IdP and set the Sync Mode
- Add a mapper so an upstream group becomes a broker role
- The moment: log in as a fresh user and watch the account appear
- Sync Mode in action: change the upstream profile, log in again
- The deprovisioning trap: remove the upstream user, watch the orphan remain
- SCIM (push) vs JIT (pull) — which, and when
- The pro move: how real deployments actually combine them
- Clean up — and what is left on your machine (nothing)