SAML JIT – Just-in-Time User Provisioning
With SAML JIT, a user is created in Qmarkets when they first log in to the system.
The user's information, such as name, department, country, and other relevant profile field details, is taken from the customer's identity system during the login process.
If the user already exists in Qmarkets, their profile information is not automatically updated.
SCIM – Automated User Provisioning
SCIM – System for Cross-domain Identity Management
SCIM provides automated and ongoing synchronization of users between the customer's identity system (Active Directory) and Qmarkets.
This means that SCIM can automatically:
Create new users.
Update users' information when their details change.
Deactivate users who are no longer part of the organization or no longer should have access.
The synchronization typically runs automatically every ~40 minutes.
Why SCIM Is Recommended Over JIT
While SAML JIT is a simple way to create users when they access the system, it has some limitations:
1. Users are only created when they log in
Until a user accesses Qmarkets for the first time, they do not exist in the system.
Therefore, they cannot receive system emails, be invited to campaigns, or be tagged/mentioned in comments.
2. User information is not kept automatically up to date
If information such as a user's department, country, or any other changes in the customer's identity system, the change is not automatically reflected in Qmarkets.
3. Users who leave the organization are not automatically deactivated
If a user is removed from the customer's identity system, JIT does not automatically communicate this change to Qmarkets. The user may therefore remain active in Qmarkets unless they are manually deactivated.
In Summary
SCIM provides a more complete user management solution by keeping users' information and access status synchronized automatically.
For customers who want Qmarkets users to be automatically created, updated, and deactivated, we recommend using SCIM together with SAML SSO.