Gemfury uses just-in-time provisioning: users are added to your organization when they first log in through your IdP. No manual invitation is required, but users must initiate login themselves.

How It Works

When a user logs in through your SAML provider for the first time:

1. Gemfury validates the SAML assertion
2. Creates or links their Gemfury account
3. Adds them to your organization with the default role

Subsequent logins authenticate the user without changing their membership or role.

New Users

Users without a Gemfury account must create one on first login:

• Created account is linked to their SAML identity
• Added to your organization with the default role

Existing Users

Users with an existing Gemfury account:

• SAML identity linked to their account on first SAML login
• Added to organization if not already a member
• Existing memberships are preserved

Role Assignment

The default role (pull, push, or owner) is configured in your SAML settings. If you are enabling SAML for an organization with prior memberships, just-in-time provisioning will not be modify those existing memberships.

Login Methods

IdP-Initiated

Users start from your IdP (e.g., Okta dashboard):

1. Click the Gemfury application
2. Redirected to Gemfury, authenticated

Removing Users

To fully revoke a user’s access:

1. Remove them from the SAML application in your IdP
2. Remove their membership in Gemfury collaboration settings