Blueworks Live

 View Only
  • 1.  JIT Provisioning

    Posted Tue July 05, 2022 03:30 PM

    Hi, we are looking to activate JIT Provisioning on our Blueworks Live account, however, we have a question that it is asking for IBM ID Realm, but nobody on our side appears to know this value.

    We raised a support ticket with IBM but they have suggested to try adding an email address, this doesn't appear to activate this.

    Can anyone here with experience on JIT Provisioning help guide us to the appropriate detail to add in?


  • 2.  RE: JIT Provisioning

    User Group Leader
    Posted Wed July 06, 2022 12:18 PM

    Hello Simon!

    I have asked a few people to help out with this answer and hopefully I hear back from them soon with an answer/guidance for you. In the meantime, I have found this configuration guide that might be helpful and hopefully help you answer the question. I have attached the link here

    let me know if this helps you at all - I will try and get back to you with an answer soon!



    Gabriel Marte Blanco

  • 3.  RE: JIT Provisioning

    Posted Wed July 06, 2022 12:35 PM
    Thanks Gabriel, that's the guidance our admins have been working through.
    We are stuck on this bit "specify the IBMid realm that users authenticate against. The realm can't be and must be the federated realm for your organization"
    We weren't sure if it is just our 'approved' domain (like the example of or if it should be some unique code combination derived elsewhere. We have tried to research online for other IBM products but most appear to indicate it should be a unique code and we aren't sure where to get that from.
    I appreciate any pointers you can share with us.

    Simon Lant

  • 4.  RE: JIT Provisioning

    Posted Mon July 11, 2022 02:07 PM

    Hi Simon!

    To activate JIT provisioning for Blueworks Live you need to first ensure your account is enabled for SSO. Blueworks Live uses IBMid for SSO federation, here is a quick video on the process:

    Once you work with our IBMid team to setup your account for federation, the JIT feature can then be enabled.

    IBMid is the central authentication system at IBM that manages federation into Blueworks Live and many other IBM applications (such as support portal, community forums, etc).

    Here is how JIT works:  If a user with a valid email in the realm try to log into your BWL account it automatically creates an IBMid for that user and also assigns a viewer license. 

    There are two levels of JIT - one for IBMid  and the second for Blueworks Live.

    1) When a new user tries to log into Blueworks (or any IBM system) for the first time, the JIT for IBMid is triggered and the user is given an IBMid on demand. This is done through your federation setup which passes the user's first name, last name, email and country attributes upon login attempt.

    2) Once the IBMid is created then IBMid routes the user to their desired application. In this case, the user is trying to access Blueworks Live. This is where the second level of JIT comes into play:

    a) If your account's BWL JIT flag is enabled - then the user is given a viewer license on demand and they can access the published processes

    b) If your account's  BWL JIT flag is disabled - then the user gets an error that they do not have permission to access the account. This is the default setup, Blueworks Live is by invitation only - so unless an admin or user has invited a colleague, new users won't be able to login.

    If you have any additional questions or need help please go ahead and open a support case with our team via our support portal and we can guide you through the process.

    Thanks very much and have a wonderful day!

    Maryam Ahmed

  • 5.  RE: JIT Provisioning

    Posted Mon July 11, 2022 05:48 PM
    Thanks for the really detailed response @Maryam Ahmed appreciate you taking the time.
    We already have a support ticket open as the one element we cannot clarify is the value that should be included in the IBMid Realm. We have had Federated SSO in place with IBMid and Blueworks for some time, but only recently purchased viewer capacity hence the disconnected requirement to enable this feature now.
    You mention that initial set up would be with the IBMid team, rather than Blueworks, so in this instance for confirmation of the Realm value, would that also be IBMid support rather than Blueworks support, or should either route get the same conclusion?​
    Thanks again for your guidance.

    Simon Lant

  • 6.  RE: JIT Provisioning

    Posted Mon July 11, 2022 06:04 PM
    Edited by Maryam Ahmed Mon July 11, 2022 06:18 PM
    Hi Simon,

    Thanks for the additional details and for clarifying your SSO is already enabled. The IBMid Realm should be identical to your federation's entity ID.

    For example, if the entity ID for your federation with IBMid is then this will also be what you enter for the IBMid realm value. Please note the entity ID is different than your SSO login URL. This entity ID was created by your company's IT/SSO team upon initial federation setup and yes only the IBMid team has access to this information, unfortunately the Blueworks Live support team cannot see the federation details.

    However if you already have a case open, then the Blueworks Live team will engage the IBMid federation team on your behalf and confirm the Entity ID/Realm ID for you to input into your BWL account.

    Maryam Ahmed

  • 7.  RE: JIT Provisioning

    Posted Mon July 11, 2022 06:20 PM
    Thanks again, I also believe our support ticket got updated earlier with the same information, so I appreciate you echoing it here.
    We will follow up with the relevant teams following your guidance.

    Simon Lant