JIT domain mapping setup for new users

​

Summary

New-user JIT domain mappings assign users to a Braintrust organization and optionally to a permission group based on their email domain. Missing or misconfigured Okta SAML attributes or metadata can prevent mapping. The checklist below covers what to submit to support, and the testing section shows how to verify the setup with a new Okta user before wide rollout.

​

What is happening

A domain mapping matches new sign-ins by email domain and adds the user to one Braintrust organization. Each mapping can also grant one existing permission group. A mapping can be configured with no permission group. In that case the user becomes an organization member but gets no permission-group grant from the mapping. Changes to a mapping only affect users who join the organization after the change. Existing users are not moved automatically.

​

Fix or suggestion

​

Step 1: Coordinate setup with support

Submit a support ticket with the following information:

1. Email domain or domains to map, for example, example.com.
2. Target Braintrust organization for each domain.
3. Whether every matching IdP user should join or only users in specific IdP groups, including the names of those groups.
4. Name of the permission group to grant for each mapping, or state no permission group if none is desired.
5. Whether you want IdP-initiated login via the Okta tile enabled.

​

Step 2: Configure the Okta SAML application

1. Create a SAML app in Okta and enter the support-provided values for Single sign-on URL and Audience URI/SP Entity ID.
2. Map NameID to the user email address.
3. In Okta Attribute Statements, add a mail attribute containing the user’s primary email address.
4. For group-based matching, configure a multi-valued attribute named public_metadata_groups with each mapped Okta group as a separate attribute value.
5. Ask support to enable the mapping for the specified domain, providing the application’s metadata URL from its Sign On tab in Okta.

​

How to confirm it worked

1. Create a new test user in Okta with an email at the mapped domain and add them to the mapped IdP group if group-based mapping is used.
2. Assign the test user, directly or through a group, to the Braintrust application in Okta.
3. Attempt to sign in via SAML.
4. Verify the new account appears in the target Braintrust organization and that the permission group assignment matches the mapping. If you configured no permission group, confirm the user is an org member with no permission-group grant.

​

Notes

• If SCIM manages the target organization’s membership, use its mapped SCIM group to provision users. Domain mappings no longer add users to that organization.