We're currently on Data Center using the Resolution SSO add-on which is very powerful, and flexible. We have it designed where inactive users are automatically cycled out as our user licenses get low.
The nice thing is if those inactive users try to login in the future, they are automatically reassigned back their license, and we cycle out another inactive user by age automatically. All users can continue to submit Portal tickets.
This solution helps ensure we fully utilize our seat capacity as much as possible.
I'm trying to model a solution as close to this as possible in Guard, but it's a bit more challenging out-of-the-box. So far, the best idea I have is:
1. Provision all my users via SCIM to Okta but place them by default into a non-billable state. This ensures all my users are visible in the user pickers, and they can submit Portal tickets.
2. Setup a rule in Okta that automatically places my core users into jira-users group. But I'll also create a group in Okta called "Inactives" that I can place users in. If they are in that group, they will automatically removed from the jira-users group. I will probably also setup a workflow action in Okta to perform an instant group removal from that group in Jira as well.
The part that I'm stuck on is how can I dynamically reassign them a license back if they attempt to login? Seems like I could create a mini Forge app that listens on user-login events but it would be asynchronous from what I understand. So on the user's first attempt to open a link to a ticket, they may get denied until they refresh.
