A customer has configured the JIT, and the user created by the process is trying to log in to the Prisma Cloud console. The user encounters the…

Just-In-Time (JIT) provisioning in Prisma Cloud creates a user account upon their first successful SSO login. The user's role is assigned based on attributes passed in the SAML assertion from the Identity Provider (IdP). If the attribute name configured in Prisma Cloud's JIT settings does not exactly match the attribute name sent by the IdP, Prisma Cloud cannot map the user to a role. This results in an authorization failure, as the user has no permissions within the console.

B. The user is created by the JIT process upon the first login attempt, so the user does exist, but they lack a role.

C. Authentication is handled by the IdP via SSO; the user does not enter a password directly into the Prisma Cloud console.

D. While the user does not have a role assigned, this is a symptom. The root cause is the misconfiguration of the attribute name (A).

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Configure SAML Integration with JIT User Provisioning". In the troubleshooting section for JIT

it is often noted that attribute mapping is a common point of failure. The guide states

"Enter the name of the attribute that defines the role for a user in the SAML assertion." If this is incorrect

role assignment fails.

2. Palo Alto Networks

Prisma Cloud Docs. "Add a SAML 2.0 IdP for SSO to Prisma Cloud". The documentation emphasizes the need to "Map the attributes on your IdP to the Prisma Cloud attributes." An incorrect mapping for the role attribute is a primary cause of login errors for JIT users.