Gemfury uses just-in-time provisioning: users are added to your organization when they first log in through your IdP. No manual invitation is required, but users must initiate login themselves.

How It Works

When a user logs in through your SAML provider for the first time:

1. Gemfury validates the SAML assertion
2. Creates or links their Gemfury account
3. Adds them to your organization with the appropriate role

Subsequent logins authenticate the user without changing their membership. When group mapping is configured, their role is re-synced from their IdP groups on each login.

New Users

Users without a Gemfury account must create one on first login:

• Created account is linked to their SAML identity
• Added to your organization with the appropriate role

Existing Users

Users with an existing Gemfury account:

• SAML identity linked to their account on first SAML login
• Added to organization if not already a member
• Existing memberships are preserved

Role Assignment

New members receive the default role (pull, push, or owner) configured in your SAML settings. If group mapping is configured, the role comes from the user’s IdP groups instead, and is re-synced on every login. SAML login never removes an existing membership — it only updates the role.

Login Methods

IdP-Initiated

Users start from your IdP (e.g., Okta dashboard):

1. Click the Gemfury application
2. Redirected to Gemfury, authenticated

Removing Users

To fully revoke a user’s access:

1. Remove them from the SAML application in your IdP
2. Remove their membership in Gemfury collaboration settings

To automate this process, enable SCIM provisioning. With SCIM, your IdP automatically removes a user’s organization membership when they are unassigned from the application. SCIM-managed members must be removed in your IdP — not from the Gemfury dashboard.