Thanks for the really detailed response
@Maryam Ahmed appreciate you taking the time.
We already have a support ticket open as the one element we cannot clarify is the value that should be included in the IBMid Realm. We have had Federated SSO in place with IBMid and Blueworks for some time, but only recently purchased viewer capacity hence the disconnected requirement to enable this feature now.
You mention that initial set up would be with the IBMid team, rather than Blueworks, so in this instance for confirmation of the Realm value, would that also be IBMid support rather than Blueworks support, or should either route get the same conclusion?
Thanks again for your guidance.
------------------------------
Simon Lant
------------------------------
Original Message:
Sent: Mon July 11, 2022 01:17 PM
From: Maryam Ahmed
Subject: JIT Provisioning
Hi Simon!
To activate JIT provisioning for Blueworks Live you need to first ensure your account is enabled for SSO. Blueworks Live uses IBMid for SSO federation, here is a quick video on the process: https://www.youtube.com/watch?v=c9tfADu-750
Once you work with our IBMid team to setup your account for federation, the JIT feature can then be enabled.
IBMid is the central authentication system at IBM that manages federation into Blueworks Live and many other IBM applications (such as support portal, community forums, etc).
Here is how JIT works: If a user with a valid email in the realm try to log into your BWL account it automatically creates an IBMid for that user and also assigns a viewer license.
There are two levels of JIT - one for IBMid and the second for Blueworks Live.
1) When a new user tries to log into Blueworks (or any IBM system) for the first time, the JIT for IBMid is triggered and the user is given an IBMid on demand. This is done through your federation setup which passes the user's first name, last name, email and country attributes upon login attempt.
2) Once the IBMid is created then IBMid routes the user to their desired application. In this case, the user is trying to access Blueworks Live. This is where the second level of JIT comes into play:
a) If your account's BWL JIT flag is enabled - then the user is given a viewer license on demand and they can access the published processes
b) If your account's BWL JIT flag is disabled - then the user gets an error that they do not have permission to access the account. This is the default setup, Blueworks Live is by invitation only - so unless an admin or user has invited a colleague, new users won't be able to login.
If you have any additional questions or need help please go ahead and open a support case with our team via our support portal https://www.ibm.com/mysupport/s/?language=en_US and we can guide you through the process.
Thanks very much and have a wonderful day!
------------------------------
Maryam Ahmed
Original Message:
Sent: Tue July 05, 2022 03:28 PM
From: Simon Lant
Subject: JIT Provisioning
Hi, we are looking to activate JIT Provisioning on our Blueworks Live account, however, we have a question that it is asking for IBM ID Realm, but nobody on our side appears to know this value.
We raised a support ticket with IBM but they have suggested to try adding an email address, this doesn't appear to activate this.
Can anyone here with experience on JIT Provisioning help guide us to the appropriate detail to add in?