Authenticate your signers using your SSO solution (and optionally entitle them to use the Acrobat Sign product)

Overview

"Just in time" (JIT) user provisioning refers to a configuration in the Adobe Admin Console that automatically creates a new user profile in the configured organization as the result of some configured trigger.

The below documentation describes the configuration process for requiring your signers to authenticate using your federated SSO solution when accessing an agreement for their participation. This allows for the Acrobat Sign authentication method to be used without the recipient being a licensed user in the Acrobat Sign system.

An optional configuration can automatically add the recipient to the Acrobat Sign product profile, entitleing them to use of the Acrobat Sign solution.

Prerequisites

• The Acrobat Sign account must be entitled through the Adobe Admin Console.

Steps to configure the Admin Console:

The user experience

Once the Admin Console is configured, users in the claimed domain trigger automatic user creation by attempting to access an agreement for participation or by use of the Acrobat Sign authentication method.

Both options prompt the user to enter an email address, which triggers the authentication process.

The authentication system:

1. Parses the domain out of the email address.
2. Identifies the Admin Console organization the user should be in (based on the claimed domain).
   
3. Retrieves the SSO configuration information.
4. Redirects the user to authenticate against the configured SSO solution.

Upon successful validation from the SSO, the user is:

1. Created in the account (if the user does not already exist).
2. Added to the product profile (if the Admin Console is configured to do so (Step 4) and the user is not already a member).
3. Authenticated to view and interact with the agreement.

After the user is created, they can authenticate to the Admin Console and interact with any entitled product profiles they are assigned to.