Moving the common User Provisioning fields under 'Runtime Configuration of End-user Onboarding' section.

Author: Karuna-Mendix

content/en/docs/appstore/use-content/platform-supported-content/modules/oidc.md

@@ -521,15 +521,43 @@ You can set up custom user provisioning by setting the following constants. You
 
 #### Runtime Configuration of End-user Onboarding{#custom-provisioning-rt}
 
+By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying Default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime).
+
 You can set up just-in-time user provisioning as follows:
 
 1. Sign in to the running app with an administrator account.
 2. Navigate to the `OIDC.OIDC_Client_Overview` page which is set up in the app navigation.
 3. In the **IdPs for SSO and API security** tab, click **New** and access the **UserProvisioning** tab.
 
+Below fields are available in the **UserProvisioning** tab for the User Provisioning configuration.
+
+* **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`.
+* **The attribute where the user principal is stored** – unique identifier associated with an authenticated user.
+* **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log.
+    * By default, the value is set to ***Yes***.
+* **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles.
+    * By default, the value is set to ***User***.
+* **User Type** – this allows you to configure end-users of your application as internal or external. It is created upon the creation of the user and updated each time the user logs in.
+    * By default, the value is set to ***Internal***.
+
+Under **Attribute Mapping**, for each piece of information you want to add to your custom user entity, select an **IdP Attribute** (claim) and specify the **Configured Entity Attribute** where you want to store the information.
+
+Note the following:
+
+* You cannot use the IdP claim which is the primary attribute identifying the user and you cannot use the attribute you set in **The attribute where the user principal is stored**.
+* You can map only one IdP claim to a Custom user Entity attribute.
+* The **IdP Attribute** is one of the fixed claims supported by the OIDC SSO module.
+* IdP Attributes(Claims) cannot be of type enum, autonumber, or an association.
+
+Optionally, you can select the microflow in the **Custom UserProvisioning** field to use custom logic for user provisioning. For more information, see the [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime) section below.
+
+{{% alert color="info" %}}
+If you are using module version 3.2.0 and below, you will need to refresh the module containing your microflow as described in the [Installing Mx Model Reflection](/appstore/modules/oidc/#mxmodelreflection) and select the microflow in the **Custom UserProvisioning** field.
+{{% /alert %}}
+
 ##### Default User Provisioning Configuration{#default}
 
-The User Provisioning configuration fields are available in the **UserProvisioning** tab. In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided.
+In default configuration, the custom user entity is set as `Administration.Account`, the principal attribute is set as `Name`, and the default attribute mapping is provided.
 
 {{< figure src="/attachments/appstore/platform-supported-content/modules/oidc/default_provisioning.png" >}}
 
@@ -547,7 +575,7 @@ You can set up custom JIT user provisioning as follows:
 
     * **Custom user Entity (extension of System.User)** – the Mendix entity where you will store and look up the user account. If you are using the [Administration module](https://marketplace.mendix.com/link/component/23513), this would be `Administration.Account`.
     * **The attribute where the user principal is stored** – unique identifier associated with an authenticated user.
-    * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message stating that the login action was successful but no user has been configured.
+    * **Allow the module to create users** – this enables the module to create users based on configurations of JIT user provisioning and attribute mapping. When disabled, it will still update existing users. However, for new users, it will display an exception message in the log.
         * By default, the value is set to ***Yes***.
     * **User role** (optional) – the role which will be assigned to newly created users. This is optional and will be applied to all IdPs. You can select any user role as a default or keep the field empty. If you need additional user roles, use Access Token Parsing microflow to assign multiple roles.
         * By default, the value is set to ***User***.
@@ -571,8 +599,6 @@ If you are using module version 3.2.0 and below, you will need to refresh the mo
 
 4. Click **Save** to save the configuration.
 
-By default, users are provisioned by [Default User Provisioning Configuration](#default). Optionally, you can customize user provisioning by [Modifying Default Attribute Mapping](#modify-default), [User Provisioning Using Your Custom User Entity](#custom_user_entity), or [User Provisioning Using a Microflow at Runtime](#microflow-at-runtime).
-
 {{% alert color="info" %}}
 If you connect multiple IdPs to your Mendix app, you can use separate custom user entities for each IdP, each with its own attribute mapping.
 {{% /alert %}}