Organization-wide Email Domain Change

Problem

When an organization undergoes restructuring and user email addresses are changed (e.g., due to a domain change), there is concern about the licensing impact in JetBrains IDE Services. Specifically, the issue is whether changing the email address will create a new user and cause the system to consume a new license while keeping the old license assigned to the previous email.

Cause

The primary identifier for user accounts on JetBrains IDE Services is the OIDC Subject ID. As such, as long as the Subject ID maintains the same, user removal/deactivation is not required, and they should be able to log in with new emails; no new users are created. Duplicated users will occur only when Duplicate user records are being created.

Resolution

There are two possible approaches to address this problem depending on how the email change and new accounts are being handled:

1. If New Accounts Are Created for Each User (and Email Address Is Modified Without Creating New Accounts + Subject ID is maintained):

   • Deactivate or ban the old accounts while enabling the new ones. No further changes to the system configuration are needed in this case. Users should be able to log in with new emails without issues. This approach avoids the need for JetBrains Hub integration.

2. If the Email Address Is Modified Without Creating New Accounts (and for some reason the Subject ID is changed causing user duplication):

   • Integrate JetBrains Hub with your On-Premises JetBrains IDE Services instance.
     • IDE Services On Prem SAML with Hub On Prem
     • Introduction To HUB
   • Use the Hub's Merge User Accounts feature to merge data from the old email user profile to the new one. This ensures roles, group memberships, and other access rights are transferred seamlessly.
   • Configure an authentication module within Hub if not already set up. Refer to the Merge User Accounts documentation for further details.

Additional Recommendations:

• Ensure you have accurate mappings between old and new user email addresses to avoid overlap during the transition period.
• For detailed steps on banning user accounts (if Hub is integrated), refer to the JetBrains banning users guide.

In summary, deactivating the old accounts or using JetBrains Hub with account merging feature offers effective solutions to minimize disruption whilst avoiding license distribution issues in your licensing pool.